Allow all origins in CORS, restrict requests to GET. Add player listing.