support cors on metrics endpoint
need options for cors
401 on auth error
log auth errors
take auth from cors request
whitespace
buffer the inbox and add comments