starting single-sign-on and CORS