pz2.js briefly tracked elsewhere; add support for CORS and server-side sessions