Allow-Cross-Origin Domain to access /verify

not needed.