Change `rat_authorized_user` to look at `req_data ["RAT"]`
Add option for `Access-Control-Allow-Origin`