fix erronous acl config
add cors session authentication