Missing option to set Access-Control-Allow-Headers option

The Jupyter notebook module has the option `--allow_origin` which allows you to set the `Access-Control-Allow-Origin` header. However, the `Access-Control-Allow-Headers` header is missing. This results in the `X-XSRFToken` header being rejected for XHR requests, meaning that connecting from a notebook frontend hosted on another server still does not work.

There should be an option to enable the `X-XSRFToken` header under `Access-Control-Allow-Headers`.