Allow customised Access-Control-Allow-Headers to be set.

Create a setting that can be overridden so that
Access-Control-Allow-Headers can be set to specific headers.

Also document how this setting works.
Do not incorrectly double quote this string.

Otherwise the contents will also be quoted
Merge pull request #4 from akumria/custom-access-control-allow-headers

Allow customised Access-Control-Allow-Headers to be set.