finalized GET /users/incomplete/today and added CORS