Use concrete header name, as Allow-Headers does not accept wildcards