Allow X-Session CORS headers.