Allow CORS headers to not have X-*-Meta-* prefix

I don't know why this is set on all headers, but it doesn't work with how your system does things, therefore this at least allows CORS headers through.

Related to Issue #395