[bug 1087327] Fix for CORS Access-Control-Allow-Headers

r? @mythmon 

Should we just copy/reuse/share/something somehow what input has? https://github.com/mozilla/fjord/blob/master/fjord/base/utils.py#L425