Don't parse bodies manually use wrap-json-params
Remove unnecessary stuff
Medias and campaigns
FUCK CORS

It adds to Access-Control-Allow-Headers whatever comes in
access-control-request-headers