Moved CorsHandler out, improving ApiKey generator