Add Accept-Encoding to CORS headers.

- Also ensure the tests pick up all of the headers and correctly communicate what is missing.