move to new app model; add cors header; improve tests