Few fixes

It contains fixes for common cases:
* spaces in Access-Control-Request-Headers values (i.e "authorization, accept")
* case sensitivity in Access-Control-Request-Headers values (i.e "Accept" vs "accept")
* missing alloworigin in preflight request