Add CORS header to allow any origin.

We don't need CORS protection because we don't use cookies at all
(so a different origin cant exploit cookie saving to steal our
session).
Clean up whitespace/copyright/includes + minor test tweak.
Fix jersey warning
Auto refactor Only: s/Account/Device/g
Fix some whitespace
Add missing file
s/accountCache/deviceCache/g
Split Account into Device and Account definitions.