Added a configuration key to allow custom headers in CORS use case