Adding Access-Control-Request-Headers support

To be full CORS compliant,  `Access-Control-Allow-Origin` isn't the only required response header, you also need to add `Access-Control-Request-Headers` matching all values (besides `accept`) in the `Access-Control-Request-Headers` request header.
```
var ev1 = function(){
   console.log(typeof testvar)  //undefined
   testvar = 1;   //define testvar as global 
}

var ev2 = function(){
   console.log(typeof testvar) //number
}

var fn1 = function(){
    var testvar = 2; //define local scope testvar 
     ev1(); //expected "number" and set to 1
     ev2(); // expected "number"
}

fn1();
```

Variable captured on function definition from "parent" scope.
so this will be correct in case if:
```
var fn1 = function(){
    var testvar = 2; //define local scope testvar 

    var ev1 = function(){
       console.log(typeof testvar)  //undefined
       testvar = 1;   //define testvar as global 
    }

    var ev2 = function(){
       console.log(typeof testvar) //number
    }

     ev1(); //expected "number" and set to 1
     ev2(); // expected "number"
}

fn1();
```

Correct me if i'm wrong.