CORS added to StartUp.auth.cs