userId in oauth_accesstoken is string, so write string instead of the
object
Do not expect session's user as the one is set for request's oauth
Enable CORS