Added claims caching
added cors headers; allow name/role claim types; add in-mem caching