Fixes the incomplete CORS support by adding the Allow-Headers header