auth tokens allowed
test cors