Added sync endpoint for users, removed CORS code as it's no longer necessary, removed CSRF token validation for JSON requests