fix for missing cors allowed headers.