Fix PAOS HTTP header and provide invalid Accept header as defined in TR 03112-7

The invalid Accept header is needed by an eID server used in production. Hopefully this behaviour
will change in the future.
Set Swing user consents to be always on top (fixes #206)