Added Access-Control-Allow-Headers for CORS requests

Specifying Content-Type, for instance, on a CORS request would cause the request to be rejected.

For example, in Angular.js, the default is to send Content-Type when using $http.put(). This would result in the following error:

Request header field Content-Type is not allowed by Access-Control-Allow-Headers