Add Origin to AllowedHeader

Direct Upload to s3 fail on safari without this rule on cors
configuration.