Adds CORS headers for GET/PATCH /user_preferences endpoints

[#76996830]