Oddbean new post about login | logout but AFAIK, this needs to be done on khatru, because it does not expose the required objects. that's why i involved @fiatjaf in the thread.
Try to replace `io.Copy` with `http.ServeContent` and see what happens (you can fork Khatru and use go to replace khatru dependency in Haven, this is how I tested all of the CORS stuff before)