Fix for Strings.joinPath when base is the empty string.
Always load all asset types from the external base if CORS supported.

Should make things less confusing, and is actually more correct anyways
since WebAudio and WebGL require CORS for external loading.
Warn when setting externalBasePath and CORS not supported.
Only CORS blacklist the stock Android browser.