refactor: use fixed localhost-only CORS policy, make auth mandatory

package.json

@@ -30,6 +30,7 @@
 		"@types/express": "^4.17.21",
 		"@types/jest": "^30.0.0",
 		"@types/node": "^16.11.6",
+		"@types/supertest": "^6.0.3",
 		"@typescript-eslint/eslint-plugin": "5.29.0",
 		"@typescript-eslint/parser": "5.29.0",
 		"builtin-modules": "3.3.0",
@@ -37,6 +38,7 @@
 		"esbuild": "0.17.3",
 		"jest": "^30.2.0",
 		"obsidian": "latest",
+		"supertest": "^7.1.4",
 		"ts-jest": "^29.4.5",
 		"tslib": "2.4.0",
 		"typescript": "4.7.4"