add verify endpoint to check valid auth
break out cors stuff a little