much improved CORS support in server and client