use better detection if given method is allowed. check origin header only if given
validation into console
add HEAD method to check req
use given seralizer
needed to keep parts of the site without session cookie
update build config
use only host on allowed origins to be compatible with rack-protaction ( http_origin )