Added auth headers to cors allow list