not everything should be bosswaved
add some more flags to smap client
add Access-Control-Allow-Origin header (temporarily)