Fix CORS support for the request headers.

Access-Control-Request-Headers fields can contain any number of spaces, this wasn't done properly until now.

The specification of field-names say (http://tools.ietf.org/html/rfc2616#section-4.2)

   message-header = field-name ":" [ field-value ]
   field-name     = token
   field-value    = *( field-content | LWS )
   field-content  = <the OCTETs making up the field-value
                    and consisting of either *TEXT or combinations
                    of token, separators, and quoted-string>