update some specs
some improvements to work with mobile app

- respond to OPTIONS request (CORS preflight)
- return distance when ordering by location
- fix login to redirect to the correct url when using as OAuth provider