Added Authorization header to allowed cors headers.