adding accept to cors allowed headers