Use single comma separated header for IE compatibility

For the benefit of IE, generate access control headers with comma
separated values rather than a header for each value. It appears that
at least IE 11 only looks at the first 'Access-Control-Allow-Headers'
header.
v0.011