Allow-Cross-Origin Domain to access /verify

eurgh..... this feels so bloody hacky