CORS requested header handling

More information and to see what guided the implementation, see here:
http://www.w3.org/TR/cors/#access-control-allow-headers-response-header
https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS
update mea culpa accordingly
improve signature for CORS AddAllowedHeaders