fix(auth): return CORS headers for abort responses