move cors message handler prior to security handler
incorporate session tokens into client