chore(package.json): update deps
fix(server): enable CORS

Without this, Plook wasn't really useful!