Enabled CORS for arbitrary Access-Control-Request-Headers. Did so by upgrading CORS filter version -- current version's defaults match our use case, so was able to eliminate override of defaults from web.xml.