Add CORS headers to OPTIONS /auth by default + enable customizations