2nd thought disable Cors by default and just add an stub Options(Auth) method