Allow-Cross-Origin Domain to access /verify

I don't think we want this on every route.