Access-Control-Allow-Headers is more permissive

http://enable-cors.org/server_nginx.html