diff --git a/extension-ready/content.js b/extension-ready/content.js
index 2224597..57badd5 100644
--- a/extension-ready/content.js
+++ b/extension-ready/content.js
@@ -596,7 +596,6 @@ class DraftApplyExtension {
     return 'textarea,' +
       'input:not([type]),' +
       'input[type="text"],input[type="email"],input[type="tel"],input[type="search"],input[type="url"],' +
-      'input[type="number"],' +
       '[contenteditable="true"],[role="textbox"]';
   }
 
@@ -1204,7 +1203,12 @@ class DraftApplyExtension {
 
     if (el instanceof HTMLInputElement) {
       const setter = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')?.set;
-      setter?.call(el, value);
+      try {
+        setter?.call(el, value);
+      } catch {
+        // number/date/range inputs throw when value doesn't conform to their type
+        el.value = value;
+      }
       return;
     }
   }
diff --git a/render-proxy/server.js b/render-proxy/server.js
index c29d9c2..b5875e4 100644
--- a/render-proxy/server.js
+++ b/render-proxy/server.js
@@ -38,7 +38,9 @@ if (!GROQ_API_KEY || !TOKEN_SECRET) {
 const app = express();
 app.disable('x-powered-by');
 app.use(helmet());
-app.use(cors());
+app.use(cors({
+  exposedHeaders: ['RateLimit-Limit', 'RateLimit-Remaining', 'RateLimit-Reset', 'RateLimit-Policy']
+}));
 app.use(express.json({ limit: '1mb' }));
 
 function base64url(buf) {