Incoming REST handler, CORS config