cors auth, grunt for server, fixed #13