Add `Authorization` to `Access-Control-Allow-Headers` and set `Access-Control-Allow-Credentials: true`

Add Authorization to Access-Control-Allow-Headers and set Access-Control-Allow-Credentials: true: Is your feature request related to a problem? Please describe.
An application that interacts with the API via a browser cannot set the Authorization header due to the CORS headers returned by the server.