Remove object wrapper from responses

Add CORS policy for webapp