Documentation on CORS configuration.

For CORS support, differentiate between path_prefix on AJAX calls and in UI.

Not released, as this is a minor improvement.