http://dvcs.w3.org/hg/cors/raw-file/tip/Overview.html#author-request-headers demands case-sensitive comparison.
Chrome sends, e.g.: Access-Control-Request-Headers: Content-Type Firefox sends, e.g. Access-Control-Request-Headers: content-type Should we violate the spec and do a case-insensitive comparison?
