Inject CORS header into all requests automatically.
Fix typo in URL construction.