Added Common Headers to Access-Control-Allow-Headers

Wildcard value of "*" not allowed for Access-Control-Allow-Headers added common headers for browser CORS requests.