Intercepting addHeader for headers that only allow one value.

The 'Access-Control-Allow-Origin' and 'Access-Control-Allow-Credentials'
can only have a single value and would normally be set and not added.
For example, the CORSFilter calls addHeader which could possibly add the
header multiple times. When an AccessDeniedException occurs we need to
sometimes add these headers to the response. But if we do so using
response.header(name, value) these seem to be added to the already
existing (if any) header, causing the response to contain multiple
values and the brower to give an error about violating the CORS
specification.

The current "fix" is to check if one of the above headers is being added
and if so instead set the header.