Bug 1141440: OPTION response for CORS requests to REST doesn't allow X-Bugzilla headers

Bugzilla/WebService/Server/REST.pm

@@ -134,8 +134,13 @@ sub response {
         { rpc => $self, result => \$result, response => $response });
 
     # Access Control
-    my @allowed_headers = (qw(accept content-type origin x-requested-with),
-        map { tr/A-Z_/a-z\-/r } keys API_AUTH_HEADERS());
+    my @allowed_headers = qw(accept content-type origin x-requested-with);
+    foreach my $header (keys API_AUTH_HEADERS()) {
+        # We want to lowercase and replace _ with -
+        my $translated_header = $header;
+        $translated_header =~ tr/A-Z_/a-z\-/;
+        push(@allowed_headers, $translated_header);
+    }
     $response->header("Access-Control-Allow-Origin", "*");
     $response->header("Access-Control-Allow-Headers", join(', ', @allowed_headers));