[CORS] Access-Control-Request-Method

I'll try this again...

The spec makes it very succinct in its preflight request steps that
Access-Control-Request-Method should be sent, always.  However in WebKit
and Firefox I'm observing this header only being sent when there are
"author request headers" being sent in Access-Control-Request-Headers.  Is
the spec not clear in these steps, or are we all just doing it wrong? :)

Thanks,
Jarred