Allow-Cross-Origin Domain to access /verify

You should pass config through the function instead of requiring it here