Constant CORS_FIELDS 

pub const CORS_FIELDS: &[(&str, &str)];

v0.131: the CORS policy fields, offered at a field-name position inside a cors { } block. Allow-Methods is deliberately absent (derived from the routes), so the closed set is these four.