set Access-Control-Allow-Headers to Access-Control-Request-Headers (fixes #14)
set Access-Control-Allow-Headers to Access-Control-Request-Headers
(fixes #14)

The Access-Control-Allow-Headers header does not allow wildcards. It
must be an exact match:
http://www.w3.org/TR/cors/#access-control-allow-headers-response-header

prayerslayer/swagger1st,sarnowski/swagger1st,zalando/swagger1st,zalando/swagger1st,prayerslayer/swagger1st,sarnowski/swagger1st,sarnowski/swagger1st,prayerslayer/swagger1st