Add corsheaders app.
Add simple session list ctrl and remove example ctrl.