Adding authorization header CORS