created cors for "options" and changed CSRF token preferences