deviceToken can be an url, make sure every slash is regarded as part of the token
removed simplePushEndpoint, because it's now deviceToken
CORS fix