added CORS support in the server, currently open to anyone (but changeable by using the settings)
enable CORS in the UI
our css is not in the vendor dir (still needs a proper place, though)