Bug 1098291: OPTION response for CORS requests to REST doesn't allow X-Requested-With
r=glob,a=glob