API: Clarify Access-Control-Request-Header handling

'headers' was a way too generic name, and the code structure implied
it was used in place of 'resp.headers' or 'request.headers', which is not the case.
Also add comment about the purpose of this code.