adds Accept-Encoding to list of default allowed cors headers