Added {HTTP_HEADER}.put_header_key_values

This is mainly a refactoring that is useful for an upcoming PR
regarding CORS (smaller patches are better...)

Note that this also fixes a small typo where an extra space was
added when calling {HTTP_HEADER}.put_allow