Add X-User-Path and -Token to allowed CORS headers