add cors to sample
add button to call API with token