The Authorization header needs to be allowed when doing CORS because otherwise /userinfo can't work. It isn't one of the headers explicitly allowed by default by Gorilla, so we have to call handlers.AllowedHeaders() to specify it. Issues: #1532 Signed-off-by: Alastair Houghton <alastair@alastairs-place.net>