Allow CORS and send the corect status codes.
Send the response objects nicely enveloped. Chnage the life time of the token.
Modify the tests so that they are more strict with the new types of data the user class is returning.
Add the object to the response if we have it.