set  'credentials'  header in cors requests

set  'accept' and 'accept-language' headers in all requests

explicitly check specified app slug ti  identify a client as a valid 'www' type client