Adding header to Access-Control-Allow-Headers

Is there a way to do this without disabling the built in cors handling? And how would I do that if necessary, as removing

from the config file does not seem to help