allow to use x-registry-auth header with enabled cors

Signed-off-by: Vladimir Bulyga <xx@ccxx.cc>
Merge pull request #8905 from 13W/x-registry-auth

allow to use x-registry-auth header with enabled cors