Added CORS to token controller