Fixes #7

response ends up with two values for 'Access-Control-Allow-Origin' header if the server provides a value other than '*'

@vitvad