The rclone web GUI uses the Prefer header for sync/copy operations, but the CORS middleware's preflight response did not include it in Access-Control-Allow-Headers. This caused the browser to block remote GUI copy requests with a CORS policy error: Request header field prefer is not allowed by Access-Control-Allow-Headers in preflight response. Add 'Prefer' to the allowed headers list so remote GUI access works correctly for file copy operations. Fixes #9614 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>