For the benefit of IE, generate access control headers with comma separated values
rather than a header for each value. It appears that at least IE 11 only looks at
the first 'Access-Control-Allow-Headers' header.