removing urls in permisions to test the new CORS on the new database servers
so hisakonog can debug the app reverting for now

Revert "removing urls in permisions to test the new CORS on the new database servers"

This reverts commit b9d2372ad8985de95cfece6363411f73515e3ba8.
small tweeks testing why CORS is working for everthing except the _session in couchdb for #838