API: Add Access-Control-Allow-Headers in CORS preflight response