CORS added support for Access-Control-Allow-Headers: X-Requested-With, Content-Type