Fix migrations on deploy
Allow all script access, XSS risk seems low
Open the CORS door wide