Fix --cors: Don't swallow up whatever word comes after it
Add Access-Control-Allow-Headers to —cors to allow for AJAX requests