Added allowed headers to access control