title: Merge CORS response headers for IE in Micronaut
body: <p>Micronaut sends multiple headers like this:</p>
  
  <pre><code>Access-Control-Allow-Headers:   content-type
  Access-Control-Allow-Headers: authorization
  </code></pre>
  
  <p>This confuses IE, it sees only the first header. This leads to a request error like "Request header authorization was not present in the Access-Control-Allow-Headers list.".</p>
  
  <p>If the headers are merged, IE understands it:</p>
  
  <pre><code>Access-Control-Allow-Headers:   content-type, authorization
  </code></pre>
  
  <p>I solved this by replacing the CorsFilter bean as follows (using Kotlin):</p>
  
  <pre><code>@Replaces(CorsFilter::class)
  class OurCorsFilter(corsConfiguration: HttpServerConfiguration.CorsConfiguration) : CorsFilter(corsConfiguration) {
  
      override fun setAllowHeaders(optionalAllowHeaders: List&lt;*&gt;, response: MutableHttpResponse&lt;*&gt;) {
          response.header(ACCESS_CONTROL_ALLOW_HEADERS, optionalAllowHeaders.joinToString())
      }
  
  }
  </code></pre>
  
  <p>However, this feels like overkill to me, and besides it might be better to have this fixed somewhere else altogether. Is there not some other way around this, using config preferably?</p>