added authorization header to CORS