[keycloak-user] CORS for admin API