added CORS fixes to allow external logins