pretty json on output in response filter

allow only one jsession cookie
All requests get
"Access-Control-Allow-Origin:", "*"

even if only needed for OPTIONS