Fix CORS and add implicit grant

What does this MR do?

Adds missing CORS header and enables implicit oauth grant flow.

Why was this MR needed?

Web clients cannot login with oauth or password and are not allowed to use pagination X-Headers.

Does this MR meet the acceptance criteria?

• CHANGELOG entry added
• Tests
  • All builds are passing
• Conform by the style guides
• Branch has no merge conflicts with master (if you do - rebase it please)
• Squashed related commits together

What are the relevant issue numbers?

Fixes #19470 (closed), #20628 (closed), #2716 (closed)