Update cross_origin.rb

Fixes inclusion of allow_headers;provide reasonable defaults for same.
Merge pull request #5 from Bantik/master

Fix for access-control-allow-headers