Disabled crsf and enabled CORS