@darius sigh, of course CORS gets in the way https://github.com/mastodon/mastodon/issues/10400

of like, crawling posts which are publicly visible and so shouldn't need any authentication.

(i'm also bummed out to learn that mastodon doesn't allow api token access to the as resources, only to its proprietary api. as resources need digest signed requests, which of course you can't do unless you're the server which holds the signing key of a recipient.)