Always return default Access-Control-Allow-Headers whitelist

This avoids OPTIONS requests sometimes disallowed because of missing
Access-Control-Allow-Headers, probably due to cached response of
reqeuests without Access-Control-Request-Headers.