#284: null access-control-request-headers breaks default preflight