CORS and check_token dont work as intended