Rename 'headers' to allow_headers to reduce confusion. Add backwards com...

...patible

conversion from kwargs and app-config of 'headers' and 'CORS_HEADERS' to
'allow_headers' and 'CORS_ALLOW_HEADERS'.