Instead of hard-coding a list of headers, we simply echo back the requested headers. This way, all headers are permitted. Same thing with the request method.
Coverage remained the same when pulling 70ae919ca81a7d7ad2af407a529f38e48856166e on elabs:allow-all-cors-headers into 7826d0477e0e3813b1fe2ac7a596be33f7be8b62 on localmed:master.
Instead of hard-coding a list of headers, we simply echo back the requested headers. This way, all headers are permitted. Same thing with the request method.