Allow-Cross-Origin Domain to access /verify

take out all but X-CSRF-Token