routes now allow nil origin
use access token from Kynort.token