only enable cors for current_user endpoint