main.js: use CORS.
main.js: add missing closing bracket.