allow to use x-registry-auth header with enabled cors

Signed-off-by: Vladimir Bulyga <xx@ccxx.cc>