Added ad-hoc CORS (which should obviously be moved to a util class.)
and attributes for organizations, as Bob would fail to load otherwise.