restricted CORS
worked on validate auth_token