support Access-Control-Request-Headers

I guess that should be it. fixes #147
Why do you need the default parameter of `""`?