Send "Access-Control-Allow-Headers: content-type"

This allows Web apps to use XHR to make POST requests to the
validator with the correct Content-Type specified (e.g.,
"Content-Type: text/html") and so without needing to specify the
"laxtype" validation parameter.
Don't send Access-Control-Policy-Path (obsolete).