removes old user auth check, in place of shiny new middleware
adds proper cors support