enable cross-origin resource sharing and disable x-frame-options

tested, working. You have my sign-off, merge whenever you're ready.