Move Cors and Oauth to master