Clean up config.xml

access origin doesn't seem work anyway
Fix embeds by whitelisting * and using the inappbrowser plugin