Added support for aditional Access-Control headers

Hi!

I have some troubles with CORS. 
If the request sends some specific access control headers, an error like 'not allowed' happens.

In order to fix it, I just added some validation for detecting them and send the required response headers, always according with the [W3C specification](http://www.w3.org/TR/cors/#syntax).

I also changed the header names to lowercase, because HTTP node.js setHeader() is case sensitive and a problem exists when you write the same header lowercase o dashed camelcase, the browser is not case sensitive and you wil have a bad header.

I also tested if you already define some access control headers from the endpoint configuration, it will be overridden successfully, so you can continue defining your custom CORS headers from your config without any problem.

Just waiting for a new release, thanks a lot!