UiRequest and UiPassword bugs and improvements

Some missing headers will make ZeroNet refuse to serve Web Fonts and AJAX responses. MuxZeroNet/ZeroMux#5

There are two missing headers:
```
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
```

For the Web Fonts, the original specification says Web Fonts should be fetched Anonymously, which means without Cookies and other credentials. In addition, the Referrer header of font request will be set to the URL of `.css` file. We may need to put session credential information into Referrer header or Query String.

My ideas:
- Make a ZeroFrame API for getting a one-time token.
- Send a 307 redirection to `.css` requests, which contain Cookie header. Redirect the request to a virtual URL that contains a one-time token. (Never tried, don't know if Referrer header will change)

Cons: Does not work if referrer policy is set to `no-referrer`.

Start by tracing the UiRequest and UiPassword entry points and the handling of Web Fonts and AJAX responses. Confirm how the missing CORS headers affect serving, then investigate the proposed ZeroFrame token or redirect approaches and define a tested solution that preserves the required credential and referrer behavior.

Written by the indexing model from the issue text.