Issue #8: Implement CORS and authentication based on tokens, not cookies