Always return default Access-Control-Allow-Headers whitelist

This avoids OPTIONS requests sometimes disallowed because of missing
Access-Control-Allow-Headers, probably due to cached response of
reqeuests without Access-Control-Request-Headers.
Merge pull request #243 from Connexions/add-access-control-allow-headers-whitelist

Always return default Access-Control-Allow-Headers whitelist