Allow-Cross-Origin Domain to access /verify

Some of this is actually needed (Not sure yet which one) I tried with only  `X-CSRF-Token` and Chrome was complaining about 

```
XMLHttpRequest cannot load http://localhost:3000/verify. Request header field Content-type is not allowed by Access-Control-Allow-Headers. 
```