update CORS.md

CORS.md

@@ -72,3 +72,18 @@ curl -I -X OPTIONS -H "Origin: https://echo-reality.com" \
 ```
 
 The response should include the `Access-Control-Allow-Origin: https://echo-reality.com` header.
+
+### Quick test `.htaccess` for DreamHost
+
+```apache
+# TEMPORARY - Allow all origins for testing
+<IfModule mod_headers.c>
+    <FilesMatch "\.(mp3|mp4|wav|ogg|m4a)$">
+        Header set Access-Control-Allow-Origin "*"
+        Header set Access-Control-Allow-Methods "GET, HEAD, OPTIONS"
+        Header set Access-Control-Expose-Headers "ETag, Last-Modified, Content-Length"
+    </FilesMatch>
+</IfModule>
+```
+
+This limits the wildcard CORS to just media files, which is a reasonable middle ground—your audio files are publicly accessible but you're not opening up everything on the domain.