Exposing User header to CORS.