start integrating Google Authentication.
add CORS access policy so we can authenticate to GAE