Optmize allow-headers check by removing duplicate values

[TC-AVNP]

Prevents having an Allowed list with repeated values to iterate over.

Example:
When configuring "Origin" as an Allowed header, the list would be comprised of: []string{"Origin","Origin"}, lead to an unnecessary additional loop.

[evanj]

I believe this will fix problems when there may be proxied requests, which can cause an HTTP response with multiple headers, which Chrome rejects with:

Access to XMLHttpRequest at 'http://localhost:...' from origin '...' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed.

This can be worked around in the application code by stripping headers, but it seems to me that this middleware should replace headers itself, rather than adding to them.

[evanj]

Oops sorry so, I misunderstood this PR, never mind!

[jub0bs]

@rs Now that #171 has been merged, you can close this PR.