Add Access-Control-Allow-Headers response for xhr transport

This is what Safari uses, and it seems unable to connect to the server
without this header in the response.