fixed `access-control-allow-headers` in cors middleware. Please review @caolan