Temporarily disabled csrf tokens and fixed CORS Header