Jersey RestAPI: fine-tuned CORS + disabled debug