make auth cors work for both domains