Add x-session-id header to cors middleware.

And convert all simple quotes to double quotes.
Move CORS middleware to separate module.
Change CORS middleware location on settings.