x-googeauth_token added to cors allowed headers