Highlight `cors` for header authorization in doc

[deniciocode]

Only by allowing specific headers I was able to make an authorised request to the api.

 Rails.application.config.middleware.insert_before 0, Rack::Cors do
   allow do
     origins 'localhost:4200', 'http://localhost:4200/'

     resource '*',
       headers: ['Authorization', 'X-Refresh-Token', 'X-CSRF-Token'],
       expose: ['Authorization', 'X-Refresh-Token', 'X-CSRF-Token'],
       credentials: true,
       max_age: 600,
       methods: [:get, :post, :put, :patch, :delete, :options, :head]
   end
 end

[deniciocode]

max_age is not needed.