add allow headers in middleware