since the user is passed in params, and in POST they're sent as a JSON body, we need to:
1) parse the params from the JSON manually, Sinatra doesn't do that
2) add an OPTIONS route for the CORS preflight

in production the API isn't called directly from the browser, but through the PDS proxy