Commented Issue: [CORS] If there multiple Access-Control-Request-Headers present in preflight request, only the first one is picked up. [992]

However in the CORS spec:

> Let header field-names be the values as result of parsing the Access-Control-Request-Headers headers.

Notice that the last word is "headers" indicate it allows multiple headers.
Comments: Fixed by: https://aspnetwebstack.codeplex.com/SourceControl/changeset/a8b2013c4216e76f2497ef13eba653be174712f8