initial web frontend and CORS changes to web.py