document header config for cors