Fixed CORS supportedHeaders

The CORS filter currently responds with an HTTP 403 error for requests with the HTTP header `X-Requested-With`. By this, the API is not usable using JavaScript browser clients. This patch causes the CORS filter to accept any header send using `Access-Control-Request-Headers`.