more permissive cors
query stuff
update to spring 4 & update some services