Allow Content-Type via CORS

Also respond to preflights.
Add a production config

Mostly to shut some things up.