Adding Access-Control-Request-Headers support

To be full CORS compliant,  `Access-Control-Allow-Origin` isn't the only required response header, you also need to add `Access-Control-Request-Headers` matching all values (besides `accept`) in the `Access-Control-Request-Headers` request header.
accessControlRequestHeaders - this variable is local to current handler function 
And in 'requestListener' you implicitly create global variable - better clearly define it as global.