CORS for API, fix authentication logic/routes, better specs.