Added Access-Control-Allow-Headers to allow cors requests with those headers