* Implement credentialed CORS according to MDN * Fix syntax error * Move validate_api_key up so it is defined before its first usage