Adding CORS support to 401 responses.

- removed the mostly duplicate EJBExceptionHandler that I added.
Adding credentials to second login call.

- workaround for Safari and Opera that don't send the 'Authorization'
  header and contacts-mobile-picketlink-secured seems to require that
  two login as performed.