Fixed CORS stuff related to "Work to allow HTTP to be used for app pages, but still keep API stuff on HTTPS"