changes to cors authentication some code fro role exploration