UiRequest and UiPassword bugs and improvements

Some missing headers will make ZeroNet refuse to serve Web Fonts and AJAX responses. MuxZeroNet/ZeroMux#5

There are two missing headers:
```
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
```

For the Web Fonts, the original specification says Web Fonts should be fetched Anonymously, which means without Cookies and other credentials. In addition, the Referrer header of font request will be set to the URL of `.css` file. We may need to put session credential information into Referrer header or Query String.

My ideas:
- Make a ZeroFrame API for getting a one-time token.
- Send a 307 redirection to `.css` requests, which contain Cookie header. Redirect the request to a virtual URL that contains a one-time token. (Never tried, don't know if Referrer header will change)

Cons: Does not work if referrer policy is set to `no-referrer`.

首先跟踪 UiRequest 和 UiPassword 的入口点，以及 Web Fonts 和 AJAX 响应的处理方式。确认缺少 CORS 标头会如何影响服务提供，然后调查提议的 ZeroFrame 令牌或重定向方案，并定义一个经过测试的解决方案，在保留所需凭据和 referrer 行为的同时解决问题。

由索引模型根据 Issue 内容生成。