Fix websocket handling. Add Access Controler header