Updated CORS setup

Added Content-Type to the allowed headers for POST/PUT