support Access-Control-Request-Headers
cleaned up
got rid of unnecessary .get call