Return object of access points.

API date is based on developer time, not document modification time.

Instance API has to be used to update its status.

Also use bobobase_modification_time as fallback.

Also switch to decorator based logic.

Script is used on Hosting Subscription too, so such portal type shall be
protected against duplicates.

Such check is already done by allowing (or not) some transitions on workflow state

Client is sending Access-Control-Request-Headers, server shall respond with
Access-Control-Allow-Headers.