fix(auth): cors