chaning .htaccess to 'set' rather than 'add' cors header.  Chrome or maybe apache started to care that there were mutliple entries.