improve signature for CORS AddAllowedHeaders