support Access-Control-Request-Headers

I guess that should be it. fixes #147