RGW: CORS use the correct headers for checking, and validate headers as lowercase where needed