Made the configuration interface public. Any private client-specific information will be provided by a seperate /user/profile or /user/configuration instead.
Fixed a bug in the unauthorized callback that caused CORS headers not to be set when user is not logged in.