added cors headers; allow name/role claim types; add in-mem caching