CORS: respect specification regarding Access-Control-Allow-Headers

According to the specification, the value of the response header
Access-Control-Allow-Headers must contain at least all the values of the
request header Access-Control-Request-Headers to be considered a valid request.
Before this commit, only the Authorization value was present, which is enough
for Firefox but not for Chrome.
This should now work as expected.

library/server/wsf/src/wsf_request.e

@@ -958,6 +958,13 @@ feature -- HTTP_*
 			Result := wgi_request.http_transfer_encoding
 		end
 
+	http_access_control_request_headers: detachable READABLE_STRING_8
+			-- Indicates which headers will be used in the actual request
+                        -- as part of the preflight request
+		do
+			Result := wgi_request.http_access_control_request_headers
+		end
+
 feature -- Extra CGI environment variables
 
 	request_uri: READABLE_STRING_8