add accept-language to cors headers

CORS needs to know about the `accept-langauge` header.