Remove poorly configured CORS directives from RestService; add no-cache headers