fixed CORS headers and style whitelisting bugs in firefox