Closes #514 - there was latent and buggy CORS header management which is now all taken care of by our third-party CORS filter.