Fixes the incomplete CORS support by adding the Allow-Headers header

The current CORS support leaves out an important header: Access-Control-Allow-Headers. Browsers (Chrome and Firefox at minimum) take the missing header as meaning no request headers are allowed, which in turn causes the requests to fail validation. This commit adds the header using a configurable value `tsd.http.request.cors_headers`, though the default I've provided seems to work just just fine when talking to Grafana.

As the configuration value is passed as a simple string so there's no testing to be done. Validation could be done by trimming the string, breaking it up on `/,\s*/`, validating that each element contains only `[a-z0-9_.-]`, and then re-assembling the elements with `, `. It just seemed overkill to me, though it could be added.