Adding Authorization header to CORS requests when authentication enabled