Changed Access-Control-Allow-Origin response header to be space-delimited vs. comma-delimited.