Allow authorization header for CORS requests.
Avoid leaking file handle when getting derived data from FastZipPackage.
When adding DataServicePackage, download it ourselves to avoid leaving turds in AppData.