Fixed a security issue in filename path handling.

It was possible to specify a full path filename with / or \, causing a security issue when downloading (system file overwrite, ...)
Use Access-Control-Allow-Origin header on server