^$GLOBAL likely does not cache the list of the globals in the current namespace

So each time you do $Order(^$GLOBAL(name)) it gets the list and looks which global is next after the one in the name. That's fine because globals might appear and disappear between the calls.

If you'd like to loop through the globals -- use merge, and then loop through the temp variable a

merge a = ^$GLOBAL("")

Note, that your loop is much faster if you run it in the database, not namespace, as here ther are no possible mappings to account for

USER>s z1=$zh,n="" f  { s n = $O(^$Global(n))  q:n="" } w $zh-z1
3.302887
USER>zn "^^..\user"

...iris\mgr\user\>s z1=$zh,n="" f  { s n = $O(^$Global(n))  q:n="" } w $zh-z1
.098734

Please double check the version. 2023.1.3 should have the fix for this case
https://docs.intersystems.com/iris20231/csp/docbook/changes/index.html#C...

DP-423647: Process CORS request when handling requests with JWT Tokens

Category: CSP / ZEN
Platforms: All
Version: 2023.1.3

This change ensures that any request that handles JWT tokens also correctly process CORS requests, when applicable.

Though status 500 is strange by itself. Try enabling ISCLOG and see if any error is logged there