Added support for device authentication headers in CORS