chat security - CORS and tokens