Only use CORS for bin pages - not edit

Also remove the csrf from the edit page - though the impact of this is unknown...
Visual tweaks
New upgrade: login + upgrade working