Store user in the session.
Set cookie domain and key.
set more cors headers
cleanup.
test
authenticate
Allow cookies.
required for withCredentials.