Add `access_token` to allowed headers

`access_token` header is used by Waterlock Auth Engine