Allow customised Access-Control-Allow-Headers to be set.

Create a setting that can be overridden so that
Access-Control-Allow-Headers can be set to specific headers.

Also document how this setting works.