properly fix the s3 CORS api
added AllowedHeaders
fixed the api service instead of monkey patching the xml builder