Send the client_id in the XMLHttpRequests as a new parameter.

The server needs to know which client is doing the requests
in order to apply the right CORS origin policy. This can not
be done in a HTTP Header since the preflight OPTIONS request
will not send this header and so the CORS handshake will fail.

Right now this parameter is optional for the Web Client since
there is a global allowed origin list in the server but in the
future I would like to remove that paramenter. I also changed
the server so each client can define a list of authorized
origins.