1. change the static server serving root
2. remove the unnecessary express for http that actually did nothing and change it to response head 302 redirect
1. remove can request from third party to prevent CORS potential
2. separate js for client side