as with issue 110 in core, allow more access-control-allow-headers for CORS support from jquery