configure allowed headers through dic
fix exposing headers  in CORS

What i needed was not allowing the xhr to set header. I needed it to expose
them to the client.