Also needs the 'allow-http-request-headers-from' element.