Allow CORS for Accept and Authorization headers