fix for cross_origin on api/v2/user