code: private List<String> checkRequestHeaders(HttpServletRequest request, JCorsConfig config) {
  
  		@SuppressWarnings("unchecked")
  		Enumeration<String> requestHeadersHeaders = request.getHeaders(CorsHeaders.ACCESS_CONTROL_REQUEST_HEADERS_HEADER);
  
  		List<String> requestHeaders = new ArrayList<String>();
  
  		while (requestHeadersHeaders.hasMoreElements()) {
  			String requestHeader = (String) requestHeadersHeaders.nextElement();
  			Constraint.ensureTrue(config.isHeaderAllowed(requestHeader),
  					String.format("The specified header is not allowed: '%s'", requestHeader));
  			requestHeaders.add(requestHeader);
  		}
  
  		return requestHeaders;
  	}
docs: TODO: parse and validate the headers