[keycloak-user] passing tokens to a servlet with cors