add app configured headers

Add the ability to set allowed headers through application config variable CORS_HEADERS.