Access-Control-Request-Headers should not use a space when combining

[sebsebmc]

The Fetch CORS spec specifically notes that the header list that is the value of ACRH does not use combine and only uses , (comma) to join the header names.

MDN's example value for this header also does not use spaces.

The WPT test https://github.com/web-platform-tests/wpt/blob/master/xhr/resources/access-control-preflight-request-header-sorted.py tests for this strictly.

[seanmonstar]

Well that's unfortunate (as the spec even says).