Flesh out federation a bit more

- Add CORS headers
- Make it work with and without native SSL
Chose that so you can run without `sudo`ing. (You'll never actually want to run this on port 80 anyway, since you'll need a reverse-proxy in front of it.)