auth0/express-jwt — pull request #10 by godeatgod (2014-04-14 10:45:08+00:00)
Title: Fixed comma handling in access-control-request-headers

Firefox 27 and possibly other browsers sends the access-control-request-headers separated by ',', not ', '