Flesh out federation a bit more

- Add CORS headers
- Make it work with and without native SSL