Add allow headers
Login fixed
Per request logging