Add content-disposition to CORS whitelist