Fix plumbing of non-default origins (cors)
Chrome requires accept and origin in ac-allow-headers.
Merge pull request #326 from jfieber/cors

CORS fixes