* use auth to check authenticated requests (passport.authenticate() does not work)
* change queue to post
* slightly change cors settings