Allow the Link and Content-Length header through for CORS