Fix CORS & handle sessions appropriately