Respond with a 200 when POSTing to users/current if CORS
Use ShareaboutsSessionAuth for current user view, to get around CSRF