Fix/cors supported headers

The CORS filter currently responds with an HTTP 403 error for requests with the HTTP header `X-Requested-With`. By this the API is not usable using JavaScript browser clients. This patch causes the CORS filter to accept any header send using `Access-Control-Request-Headers`.