remove cors. use hapi to serve static content.

As discussed. removes the need for CORS because hapi is now serving your static assets.
Let me know if you need help with anything else.