SWC-1828: fix CORS issue.  servlet now responds with a html page that sends a postMessage on load