Added CORS for oauth2