A major simplification, CORS disabled by default, authentication and
layout working. Almost there...

$worked 6h on #8 and #7