YARN-2528. Relaxed http response split vulnerability protection for the origins header and made it accept multiple origins in CrossOriginFilter. Contributed by Jonathan Eagles.

(cherry picked from commit 98588cf044d9908ecf767257c09a52cf17aa2ec2)