one more round of corrections to Access-Control-Allow-Origin: removed basicAuth when not needed and fixed cookie match