fix: handling failed authorization, sending appropriate CORS headers even on requests that fail authentication; enh: better error handling on the client, better functions and interfaces for gen_aaa