Fix for duplicate access control headers

Fixes RavenDB-1597, where duplicate access control headers get added, thus breaking CORS.