fix CORS issue
fix refresh token
add CORS enable to config
temporarly add all and remove restriction to client for restrict domain access