[cors] Should browsers send non-user-controllable headers in Access-Control-Request-Headers?

[Benson Margulies]

Chrome sends:

Access-Control-Request-Headers:Origin, Content-Type, Accept

Is that just wrong?