Add 'Access-Control-Allow-Headers' to CORS headers

[Firefishy]

Add Access-Control-Allow-Headers: "X-Requested-With" to CORS access headers to allow browsers to send X-Requested-With request header.

[pnorman]

CI failure is related to an old version of hynek/build-and-inspect-python-package and not the PR

I'd rather not code a deployment-specific header into server but have it as you did, in the deployment code.

I was looking at Access-Control-Allow-Headers: * but it doesn't look like that will work if the client sends any cookies