[SECURITY] CORS for custom protocols

## Issue

Currently, any pages can fetch stuff from `flow`, `flow-internal` and `flow-external` protocols which is unsafe.

## Solution

Add CORS to make sure that won't work anymore