cleaned up user_management and cors handler