Allow arbitrary CORS request headers

instead of just `Range`.