Fix CORS support when publishing using Authentication header

CORS support for OPTIONS request wasn't returning 'Authorization' in the value list for the `Access-Control-Allow-Headers` header.

This just adds Authorization to the list of values returned in the 'Access-Control-Allow-Headers' header response from an OPTIONS request.

Signed-off-by: Jim Klo <jim.klo@sri.com>