Minor cors fixes

Following the cors readme, I noticed logging wasn't working:

```
$ lein run 8080
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
```

@timewald I also noticed that `/js` has a cors-interceptor. Isn't that unnecessary? Doesn't the SSE app on `/` only need that interceptor? If so I can remove it and add that to this pull