add permissive CORS to API controllers

See: https://dequeuniversity.com/rules/axe/2.1/html-has-lang

all statuses/accounts to assemble, but at least lists don't have to be
re-rendered all the time now. Also add "mention" dropdown option

to the API

Also fix reloading of timelines after merge-type events

entire timelines (only fetch since last known ID). Side effect: account
timelines no longer update in real-time

This might help with GS compatibility