server: Allow CORS, stl as form field instead of file