added CORS headers to the authServer requests