Fixed comma handling in access-control-request-headers