Revised Auth + CORS, fixed resource access