public boolean isAllowedHeader(String... header) {
        return header != null &&
                (HttpHelper.containsAll(allowHeaders, header) || HttpHelper.isSimpleHeader(header));
    }
Is an allowed header, either by user definition or the spec. Generally browsers should not ask for
fields which are always allowed but we handle that anyway.

@param header the headers
@return true if simple header(s)
plugins/cors-policy/src/main/java/io/apiman/plugins/cors_policy/CorsConfigBean.java