Allow more headers with cross-origin requests