header now specifies only Access-Control-Allow-Credentials = True, since HTTP 1.1 keeps connection alive by default
server now responds with HTTP 403 if there is any error
remove some unnecessary exports and update haddock
shorten SessionID & returns error when event malformed