Replace procedural authorization by interceptors
License headers
Cors for security
Add preflight DELETE request handler & return entity in POST response body