Allow any header if :access-control-allow-headers is nil
Rename string-to-set to parse-headers and make it more robust
Also allow requests using a subset of allowed headers