add SForce-Auto-Assign allowing request headers in CORS