CORS supported
StoredEmails#create: skip token
StoredEmail: add source field