CORS pre-flight with allowed headers