title: Access-Control-Allow-Credentials is added twice in Spring application
body: <p>For some reason I'm getting the <code>Access-Control-Allow-Credentials</code> header twice on the <code>j_spring_security_check</code> call. This is the error message I get:</p>
  
  <blockquote>
    <p>The value of the 'Access-Control-Allow-Credentials' header in the response is 'true, true' which must be 'true' when the request's credentials mode is 'include'.</p>
  </blockquote>
  
  <p>I'm using Spring 4.3.9 and Spring Security 4.2.3.</p>
  
  <p>This is my CORS configuration:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;bean id="corsConfigurationSource" class="org.springframework.web.cors.UrlBasedCorsConfigurationSource"&gt;
          &lt;property name="corsConfigurations"&gt;
              &lt;map&gt;
                  &lt;entry key="/**" value-ref="corsConfig"/&gt;
              &lt;/map&gt;
          &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="corsConfig" class="org.springframework.web.cors.CorsConfiguration"&gt;
          &lt;property name="allowedOrigins" value="${settings.cors.origin}"/&gt;
          &lt;property name="allowedHeaders" value="*"/&gt;
          &lt;property name="allowedMethods" value="*"/&gt;
          &lt;property name="allowCredentials" value="true"/&gt;
          &lt;property name="exposedHeaders"&gt;
              &lt;list&gt;
                  &lt;value&gt;X-Total-Count&lt;/value&gt;
                  &lt;value&gt;Content-Disposition&lt;/value&gt;
              &lt;/list&gt;
          &lt;/property&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>And this is how I use it in the Spring Security configuration:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;cors configuration-source-ref="corsConfigurationSource"/&gt;
  </code></pre>
  
  <p>Any idea?</p>