Update cross_origin.rb

Fixes inclusion of allow_headers;provide reasonable defaults for same.