UiRequest and UiPassword bugs and improvements

Some missing headers will make ZeroNet refuse to serve Web Fonts and AJAX responses. MuxZeroNet/ZeroMux#5

There are two missing headers:
```
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
```

For the Web Fonts, the original specification says Web Fonts should be fetched Anonymously, which means without Cookies and other credentials. In addition, the Referrer header of font request will be set to the URL of `.css` file. We may need to put session credential information into Referrer header or Query String.

My ideas:
- Make a ZeroFrame API for getting a one-time token.
- Send a 307 redirection to `.css` requests, which contain Cookie header. Redirect the request to a virtual URL that contains a one-time token. (Never tried, don't know if Referrer header will change)

Cons: Does not work if referrer policy is set to `no-referrer`.