Allow-Cross-Origin Domain to access /verify

cache this in a variable once, use it here.