* Fixes from frontend/backend url separation
This fixes the CORS and CSP headers.
Also, in thie commit, I removed the cors_supports_credentials config parameter,
which was recently introduced.
Instead, the logic determines the need to use CORS headers if the
web_page_url is set.
#1778