headers

Allowed CORS headers.