disable authorization temporarily
set response header Access-Control-Allow-Origin to allow independent frontends