allow all methods from CORS in the new decorator and add a timeout
include the primary key of a profile object into the json dict