Allowing Access-Control-Allow-Headers to always exits in response.

Motivation:
A preflight request can benefit from returning all headers that it
allows a client to send, since these headers will be stored in the
preflight cache (similar to how the request methods are stored)
which can potentially save a round trip for subsequent request
that send other/more headers.

This check will allow both empty 'Access-Control-Allow-Headers' or
contain a list of headers that the server allows.