Allow Content-Type header in CORS.
Expose Location header in CORS.