fix allow-origin header getting over-written
Merge pull request #179 from trailbehind/bugfix/allow-origin

Fix allow-origin header getting over-written after being set