Implement `Access-Control-Request-Headers`

More information and to see what guided the implementation, see here:
http://www.w3.org/TR/cors/#access-control-allow-headers-response-header
https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS