Add extra header and fix null origin

[Mecanik]

Hi, thanks for the library.

Can you please add support for: access-control-allow-headers.

Also, for me I have origins: [ '*' ], but the response is: Access-Control-Allow-Origin: null. Not sure how OK is that.

Thanks