proper CORS handling

[duncdrum]

I m escalating this TODO API#L45 to issue, so i can keep easier track of it. I m seeing CORS related errors and warnings in the e2e tests, so we'll probably have to get around to this rather sooner than later.