enable cors for /public/{ceci,vendor} and remove /test_assets

#603