Add Access-Control-Allow-Headers to —cors to allow for AJAX requests