CORS and CRSF validated with backbase