Two minor issues with standards and Chrome

The first issue with Chrome is that it doesn't support the more generic Allow header and requires Access-Control-Allow-Methods to be set.

The second issue is that the standards definitions do not allow Access-Control-Allow-Headers to be a wildcard and must be set with the individual headers.

http://www.w3.org/TR/cors/#access-control-allow-headers-response-header