Fix synth model.
Improve CORS handling.
Move authentication check out into routes.