[05-architecture]: some more fiddling around with CORS headers (Chrome definitely does not work with self-signed certificates)