Expose crossdomain in hal_app, avoid global vars

Avoid the _FLASKAPP and DATABASE global variables.

The one exception to the latter is a globally-registered event listener
which needs access to the most recently-configured database; though
ideally we could move this to being a database instance-specific
listener instead.