Can a browser on actually reach the production /apply/* API? A blocked request throws before any status code exists, so reading a response at all — even a 403 — is the proof.