added CORS and disabled basic auth on ProjectsController