Add allow headers to CORS middleware