improved CORS by case insensitive header comparison