Request header field X-File-Name is not allowed by Access-Control-Allow-Headers in preflight response.

[Paracom]

Hi I am new to CORS, i have researched on the internet and come up non the wiser.
Looking at the response for the preflight request

Access-Control-Allow-Credentials:true Access-Control-Allow-Headers:X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding Access-Control-Allow-Methods:POST, GET, OPTIONS, DELETE, PUT Access-Control-Allow-Origin:* Access-Control-Max-Age:1000 Connection:Keep-Alive Content-Length:0 Content-Type:text/html; charset=UTF-8 Date:Tue, 13 Feb 2018 21:36:34 GMT Keep-Alive:timeout=3, max=32 Server:Apache X-Powered-By:PleskLin

The "X-File-Name" is not in the Access-Control-Allow-Headers list.
even if I manually set header("Access-Control-Allow-Headers: .... in the cors.php in response to the "options request method" it always defaults to the access controls headers listed above.

I am using the sample app. It works fine when everything is same origin.

any ideas?