It won't change user experience for now until T290300 is resolved one way or the other (implement OAuth or turn off authentication), but I noticed that, unlike WDQS, WCQS is currently blocking CORS. I think the configuration needs to be changed so that, once the method for programmatic access is determined, web apps are able to access the endpoint.