Do not store the Zoho password here. Set it as the server environment variable HMSS_MAIL_PASSWORD.
HMSS_MAIL_PASSWORD
Use this when the static public website posts contact messages to HMSS at /api/contact.
/api/contact
Separate origins with commas. Include the scheme, for example https://harvestermission.org. For local testing, add http://127.0.0.1:5500 or your Live Server origin.
https://harvestermission.org
http://127.0.0.1:5500
Leave blank for no token. If set, the public contact page must send this as X-HMSS-Contact-Token.
X-HMSS-Contact-Token