loosening CORS spec for header verification