Variety of changes

Messy PR with a variety of changes, including

* CORS headers
* Fixing some bugs on
  * creating helper checkouts
  * behavior or since
* Restructure denormalized data in responses for clarity, cycle avoidance
* Bad response code in error cases for `person#show`

TODO: test, split into multiple PR's