now embeds manifest JSON, not just the URL
module for CORS support
now generates oa:Annotations
added CORS support; calls to oa_annotations()