Write only one header with comma separated values.

Several "Access-Control-Allow-Headers" headers seems to break IE10/11.