added username and passwordhash to the list of allowed headers for cors
fixed minor cors issues
resolved conflicts