Re-add support for multiple Access-Control-Request-Headers field (fixes #184)

[jub0bs]

As discussed in #184 (comment), I've implemented a fix that tolerates a small amount of whitespace around elements and a small number of empty elements:

const (
	maxOWSBytes      = 1  // number of leading/trailing OWS bytes tolerated
	maxEmptyElements = 16 // number of empty list elements tolerated
)

@rs Let me know whether those values are acceptable or should be modified.

[jub0bs]

Thanks for merging so quickly. Don't forget to release a new tagged version 😇