ensureAuthenticate by defeat CORS with all * ...Origin