[CXF-5598] Using case-insensitive comparison of allowed headers as per CORS spec
[CXF-5599] Optional support for tokens embedded in form payloads