handling CORS
api allows user to log in and get current user using session token