Allow the authorization header to be part of cors requests.