Allow browser to access X-Authentication-Token header and use Authorization header in request