move CORS handling down to Login class