fix(auth): send CORS headers with 401 response