Enable CORS for the API and remove token auth