Even for a low-activity wiki, hosting & rendering many HQ image files takes significant resources and comes with high monthly server costs.
If you're able, please consider contributing to keep the site running to help support this independent, ad-free, fan-run site. Thank you!
MediaWiki:Apihelp-main-param-crossorigin
When accessing the API using a cross-domain AJAX request (CORS) and using a session provider that is safe against cross-site request forgery (CSRF) attacks (such as OAuth), use this instead of origin=* to make the request authenticated (i.e., not logged out). This must be included in any pre-flight request, and therefore must be part of the request URI (not the POST body).
Note that most session providers, including standard cookie-based sessions, do not support authenticated CORS and cannot be used with this parameter.