Allow custom headers in CORS for async API

### Notes

We currently use `gorilla/handlers` for CORS, which does not support `*` in their `handlers.AllowedHeaders()` function. Therefore, if the user sets a custom header in their request, the async-gateway will respond with 403 Forbidden. The request will work if no additional headers are added by the user.