Fix for access-control-allow-headers

Fixes inclusion of allow_headers;provide reasonable defaults for same.