Fixes for XFO headers: browsers don't seem to like multiple headers, and
we missed the required ALLOW-FROM clause.

@rev goliver@
@bug W-2390049@
Merging origin/fabbott/master-pending/xfo-fix-for-emailclient into master