Allow-Cross-Origin Domain to access /verify

We only need to allow POST & GET, based on the routes defined in routes.js