enable CORS on pledge and payment_config handlers
spell out and soft-code the pledge url

This enables reuse on other subdomains, and easy to use development url
use full URL for receipt redirect