Added `42-auth-token` to list of allowed cors headers