Allow-Cross-Origin Domain to access /verify

do this outside as well.