Fixes for CORS

New headers required, and must pass the value we know the browser will send in origin on to the docker container, so that the ipython server inside docker can set the correct `Access-Control-Allow-Origin` header. See comments for more info