Allow all X-Imbo-* headers on CORS-requests
Made CORS-listener have a higher priority than AccessToken/Authenticate-listeners
Merge pull request #298 from rexxars/cors-allow-imbo-headers

Allow Imbo-headers for CORS-requests