adding auth for cors