Add missed 'Authorization' to list of allowed headers in CORS.