fix(security): close CSRF holes in CORS enabled API