Allow the authorization header to be part of cors requests.
updated integration tests with cors header update.