Your app appears to be sending a "multipart" Content-Type, instead of one of the allowed values: "application/octet-stream" or "text/plain; charset=dropbox-cors-hack". You'll need to make make sure your app only sends one of those allowed values.
Exactly how you do this depends on what SDK/library/HTTP client you're using. It looks like you're probably not using one of our SDKs, so I'm afraid I can't offer specific instructions. Sometimes, HTTP clients will automatically choose a Content-Type value like that, so you'll need to refer to the documentation for whatever client you're using for instructions on how to specify it properly.
