Allow CDMI headers for CORS (STOX-37)