add CORS filter and change filter to allow the "admin" user to be returned