CORS cleanup and Authorization header addition