remove useless parameters for CORS
use token with expiration date for the authentication