Allow-Cross-Origin Domain to access /verify

don't need DELETE