Hotfix: Add accept and x-csrftoken headers to the CORS allowed list