enable cors on metadata endpoint; validate id tokens in JS client