Update net::HttpUtil::IsSafeHeader() with two new headers

net/http/http_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // The rules for parsing content-types were borrowed from Firefox:
 // http://lxr.mozilla.org/mozilla/source/netwerk/base/src/nsURLHelper.cpp#834
 
 #include "net/http/http_util.h"
 
 #include <algorithm>
@@ skipping 298 matching lines @@
   return true;
 }
 
 namespace {
 // A header string containing any of the following fields will cause
 // an error. The list comes from the XMLHttpRequest standard.
 // http://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader-method
 const char* const kForbiddenHeaderFields[] = {
   "accept-charset",
   "accept-encoding",
+  "access-control-request-headers",
+  "access-control-request-method",
   "connection",
   "content-length",
   "cookie",
   "cookie2",
   "content-transfer-encoding",
   "date",
   "expect",
   "host",
   "keep-alive",
   "origin",
@@ skipping 527 matching lines @@
       value_is_quoted_ = true;
       // Do not store iterators into this. See declaration of unquoted_value_.
       unquoted_value_ = HttpUtil::Unquote(value_begin_, value_end_);
     }
   }
 
   return true;
 }
 
 }  // namespace net