cors stuff, and set onStanza handler once per session