Remove nonexistent PHP 8.5 constraint, restrict CORS allowed_headers

config/cors.php

@@ -25,7 +25,7 @@ return [
 
     'allowed_origins_patterns' => [],
 
-    'allowed_headers' => ['*'],
+    'allowed_headers' => ['Content-Type', 'X-Requested-With', 'Authorization', 'X-XSRF-TOKEN'],
 
     'exposed_headers' => [],