Authenticated access to Google APIs with CORS