Allow curl requests to any HTTPS host; remove experimental domain allowlist

Document verified curl support and add live browser HTTP tests

Enable browser HTTP commands with CORS-aware errors and bounded requests