Added instructions for CORS on gs. Corrected some policy bugs.