$wgAllowedCorsHeaders