properly allow multiple Access-Control-Allow-Headers

[lastlink]

Reference: https://www.drupal.org/files/issues/cors-multiple-Access-Control-Allow-Headers-not-working-2823583-1.patch patch 2 src: https://www.drupal.org/files/issues/cors-multiple-Access-Control-Allow-Headers-not-working-2823583-1.patch multiple headers were not properly separating, but instead only the last one of the comma separated list was being used.