title: Will duplicate "Access-Control-Allow-Origin: *" headers break CORS?
body: <p>So we have an http resource that serves up JSON. It adds an</p>
  
  <pre><code>Access-Control-Allow-Origin: *
  </code></pre>
  
  <p>flag. So this can be loaded with CORS... <em>except</em> (so I'm told) there's some IE9 quirk that means this still won't work in IE9, but it would work if this were an https resource. </p>
  
  <p>So we set up an existing https proxy to include this resource. Only that https resource was ALSO adding the Access-Control-Allow-Origin: * header, so the response contains TWO such headers. </p>
  
  <p>And this seems not to work at all. Experimentally it looks like if I remove the header from the "inner" http resource, the proxied version (now containing just the one header) does work. Just testing with jQuery CORS in Chrome, Firefox. </p>
  
  <p>Is that right? So all I need to do is (have somebody) fix the https proxy to "set" the header and not of "add" it? </p>