add support for two-way CORs config serialization. plus tests.