CORS tokens for annotator
relax assumptions on source being emails
extract logic for annotator