Allow Cors withCredentials, decode paths for zips, update uri parsing