API: Add User-Agent to CORS allow list