test(cors): add CORS tests for auth

use `dredd` for testing