cors request support
fix signup obvious bugs. add flash in MsgCtrl