Simplify Cors controller
Add TODO in auth controller