added Authorization to CORS headers