case insensitivity for commands, CORS flags