Enable CORS; rename /puzzles => /puzzle

Also, add desc field to GET *