CORS Filter: Access-Control-Request-Headers more than one header will cause preflight to fail

[jchenry]

Access-Control-Request-Headers can be a comma delimited list. when more than one element is in this list, isValidAccessControlRequestHeader in cors_filter.go will fail for even valid requests.

to test:

change cors_filter_test.go:20 to:
AllowedHeaders: []string{"X-Custom-Header, X-Additional-Header"},
and line 29 to:
httpRequest.Header.Set(HEADER_AccessControlRequestHeaders, "X-Custom-Header, X-Additional-Header")

[emicklei]

I have changed the test like you described and indeed see the test failed. Will work on it now.