test-acah.php

<?php

/**
 * Plugin name: Test Access-Control-Allow-Headers
 */

add_action( 'admin_menu', 'test_acah_admin_menu' );
function test_acah_admin_menu() {
	add_management_page( 'Test Access-Control-Allow-Headers', 'Test ACAH', 'manage_options', 'test-acah', 'test_acah_admin_page' );
}

function test_acah_admin_page() {
	?>

	<div class="wrap">
		<h1>Test!</h1>
        <pre></pre>
	</div>
	<script>
		(function($){
			$.ajax( {
				url:        '<?php echo esc_js( rest_url() ); ?>wp/v2/users/1/',
				method:     'GET',
				beforeSend: function( xhr ) {
					xhr.setRequestHeader( 'X-WP-Nonce', '<?php echo esc_js( wp_create_nonce( 'wp_rest' ) ); ?>' );
				}
			} ).done( function( response ) {
			    console.log( response );
			    $( '.wrap > pre' )
                    .text( JSON.stringify( response, null, 2 ) )
                    .before( '<h3>User ID 1 details, fetched from the REST API:</h3>' +
                            '<p><em>(if it includes a `capabilities` key then it\'s an authenticated request)</em></p>' );
			} );
		})(jQuery);
	</script>

	<?php
}