Serve pre-defined files in "public", add "security.txt", add CORS header for ".well-known"

Serve pre-defined files in "public", add "security.txt", add CORS header for ".well-known" #5649