allow content-type header in CORS