Fixed comma handling in access-control-request-headers

Firefox 27 and possibly other browsers sends the access-control-request-headers separated by ',', not ', '