* Bump CORS to a year, and strictly prefer SSL.
* Hashless path syntax as prompted by @gugod