CORS

security.CORS() allows the origins in CORS_ALLOWED_ORIGINS (comma separated) and none when it is empty. Tokens travel in the Authorization header, not in cookies, so there is no CSRF to defend against.