CORS support
- FIX: allow CORS authentication call