move mongo subscriber bits out of main, add CORS subscriber, move CSRF token out of renderer to the subscriber
add response to OPTIONS method called by ajax rest client
rearange predicate order so it's same for all view decorators