Fixed CORS failures with runtime host permission. Restored broad host access so WebDAV fetches no longer hit CORS errors, meanwhile retaining the previous permissions approach for future iterations.

Tightened permissions so users no longer have to grant “access your data for all websites.”