General changes to the model

- made the `run` cmds in `main.als` more interesting (and the instances
  generated are now easier to understand -- reduced the bounds).
- moved the `Origin` sig to the `http` module.
- changed the same origin policy `fact` to include the CORS relaxation
  to the policy.
- some other misc fixes.