allow custom headers on all pages
Merge pull request #5169 from Carreau/allow-cors

Allow custom headers in tornado