Adding Access-Control-Request-Headers support

To be full CORS compliant,  `Access-Control-Allow-Origin` isn't the only required response header, you also need to add `Access-Control-Request-Headers` matching all values (besides `accept`) in the `Access-Control-Request-Headers` request header.