pass over 2.1; tweaked csp, postMessage &cors -- pass req