Add token to xml response and allow cross origin resource sharing