More realistic examples of allowed headers in a CORS request