CORS pre-flight with not allowed headers