add cors support
decode the session token