adding cors header exceptions for accept/content-type