Allow Content-Type header to be set for CORS