add HTTP response header Access-Control-Allow-Origin with value *
Some clients may change the order of CMP requestor and responder, relax the
check
ca-cmp: accept null certprofile
ca-server: better format
reduce number of methods in RAWorker