Handle comma separated values in Access-Control-Request-Headers

Not only may there be multiple Access-Control-Request-Headers, each header may contain a comma list of header names.

Author: mficzel

Classes/Http/CorsHeaderMiddleware.php

@@ -319,6 +319,8 @@ private function areHeadersAllowed(array $headers): bool
         if ($this->allowedHeadersAll || $this->allowedHeaders === []) {
             return true;
         }
+        // each header may comma seperated itself
+        $headers = array_merge(...array_map(fn(string $line) => explode(',' , $line), $headers));
         foreach ($headers as $header) {
             if (!in_array($header, $this->allowedHeaders, true)) {
                 return false;