Allow-Cross-Origin Domain to access /verify

well, I guess you're expecting this to be parse-able by habitat, so '[]' should be used.