Access-Control-Allow-Origin header was set twice in AuthController.redirectToCurrentUser