Issue description

Now our cors plugin work in header_filter phase, so if someone enables both auth plugin(such as key-auth or jwt-auth) and core plugin, then authenticate failed, the cors header will not append to header, it will cause browser raising a cors error and drop the response.

I think we should:

• Change the core plugin work in rewrite phase (I will do it today)
• Change auth plugins work in access phase, I think the authentication would better be doing in access phase, it is design for it.

Welcome to discuss.