cors should be in routes
removed CORS from routes.coffee
clean up code and add stateless option to Google Strategy