rgw: cors subresource needs to be in canonical auth header

Fixes: #5789

This was fixed before, however, might have been lost due to
recent refactoring + merge.

Signed-off-by: Yehuda Sadeh <yehuda@inktank.com>