Flesh out federation a bit more

- Add CORS headers
- Make it work with and without native SSL
Calling this public key instead of certificate may cause confusion.
These two variable should probably have a ```_PATH``` suffix.