Adding authorization header for CORS