Added CORS
starting token auth
Locked down API controller with Tokens