add login controller and configure TokenServices
fix CORS configuration issues