Some PEP8 formatting
Add CORS headers as environment option

Defaults to '*'

[delivers #43256257]