allows CORS
oauthd_v.sh -> verbose server