add: support for CORS
add: support for logging out without providing an access token via DELETE /api/v0/sessions