and in cors_allow_headers in settings