Filter response headers in XHR

Passes a couple of wpt tests
Blocks #2525