setup CORS for user account management