Move some code to init phase
Use comma separated values for CORS response headers

Instead of multiple headers with same name.
This makes IE happy, and saves a few bits.