Add headerAllowOrigin to preflight requests