Added X-Auth-Token in allow header