allow the cors middleware to be completely configurable and enrich default headers allowed