> I could do something awkward like .... add my own middleware to handle Access-Control, then supertokens' middleware, then my actual handler This is the way I have seen in most projects, so this is what i'd recommend.