Dynamically allow all CORS requests by echoing back requested headers

Instead of hard-coding a list of headers, we simply echo back the requested headers. This way, all headers are permitted. Same thing with the request method.