Dubious endpoint to update (i.e., finish) a step on a session

Had to use a proper CORS handler for PUT, which required turning all the
handler functions into interfaces