Auth nearly working. Need a callback to CORS. Painful.