Fixing Chrome CORS headers bug

Chrome updated the kinds of headers they send on preflight CORS OPTIONS requests. To future-proof the CORS filter, we want to enable arbitrary values of the 'Access-Control-Request-Headers.' I enabled CORS for arbitrary values of 'Access-Control-Request-Headers' by upgrading CORS filter version -- the CORS filter's current version's defaults match our use cases for *cors.allowOrigin* and *cors.supportedHeaders*, so I was able to eliminate the override of defaults from web.xml.