Omit Access-Control-Allow-Headers if Access-Control-Request-Headers not present on request