Supports CORS.

Adds `LockerRequest` and no longer requires `registration` for states.

#371 #360