Allowed request headers for the preflight Access-Control-Allow-Headers response.

OMITTED (the default): an allowed origin's preflight ECHOES the request's Access-Control-Request-Headers, and the response carries Vary: Access-Control-Request-Headers.

The previous default was an empty list, which advertised no headers at all while methods defaulted to every standard verb — so the preflight offered POST/PUT/PATCH/DELETE and then refused content-type, the one header a JSON body needs. Every browser blocked every JSON request.

Echoing does not widen the security boundary: the ORIGIN allowlist is what decides, and it is unchanged — a caller that reaches this branch has already been admitted, and the header it is asking for is one it is already sending. Configure a list to deny everything outside it.