Drop Origin and Accept from the value of the Access-Control-Allow-Headers response header.