added headers to cors allowed headers