Feature/rm cors

removes CORS, replaces with a `/proxy/` path.

client has no need for knowledge of COOPR_SERVER_URI anymore.

see https://issues.cask.co/browse/COOPR-556 
Should this be authorization?