The Authorization header needs to be allowed when doing CORS because
otherwise /userinfo can't work. It isn't one of the headers
explicitly allowed by default by Gorilla, so we have to call
handlers.AllowedHeaders() to specify it.
Issues: #1532
Signed-off-by: Alastair Houghton <alastair@alastairs-place.net>
