v1.0-preview: fixed security config to allow browser loading static resources witho…

Pre-release with a working backend and functional UI.

TODO:
In this build, when files uploaded are downloaded from UI, they don't have their original filenames, but just have the name download.