Configure CORS-filter to expose Allow-header to browsers