Add Content-Type to allowed headers in CORS filter