built-in web server — returns resources as Access-Control-Allow-Origin