Only use CORS for bin pages - not edit

Also remove the csrf from the edit page - though the impact of this is unknown...
3.18.7