Allow X-User-Path, X-User-Token in elasticsearch CORS headers