Cors headers

Add a few headers to those always allowed by CORS.
Improved internal documentation about CORS headers and remove a few lines of vestigal code.

Improved security documentation.