Tweaks to improve CORS with auth, plus removing /noauth from secured
resouces