pub const CORS_ALLOWED_HEADERS: [HeaderName; 5];Expand description
The request headers an atproto client sends and a preflight must name.
authorization and dpop carry the two credentials, content-type is
on every procedure call, and atproto-proxy / atproto-accept-labelers
are what the official client adds to every request whether or not the
server it reaches acts on them. A header left off this list makes the
browser refuse the request before it is sent, so the list is the
client’s, not this server’s.