Lots of changes to get cors and csrf working