Chrome + CORS on ipfs.io

[jbenet]

I'm seeing the CORS:

> curl -I https://ipfs.io/ipns/ip
HTTP/1.1 200 OK
Server: nginx/1.9.3
Date: Sun, 06 Sep 2015 03:41:17 GMT
Content-Type: text/plain; charset=utf-8
Connection: keep-alive
Access-Control-Allow-Origin: https://gateway.ipfs.io
Access-Control-Allow-Origin: https://ipfs.io
Access-Control-Allow-Origin: http://gateway.ipfs.io
Access-Control-Allow-Origin: http://ipfs.io
Access-Control-Allow-Origin: http://localhost
Access-Control-Allow-Origin: http://localhost:8080
Access-Control-Allow-Origin: http://127.0.0.1
Access-Control-Allow-Origin: http://127.0.0.1:8080
Suborigin: ipfs.io
X-Ipfs-Path: /ipns/ipfs.io/
Strict-Transport-Security: max-age=15768000

On chrome i get

https://gateway.ipfs.io/ipfs/QmWCobpCNQy9SN19mcauGw4HR5p1KBcTvL6ousavdpJxqt/12/3790/2375.pbf. The 'Access-Control-Allow-Origin' header contains multiple values 'https://gateway.ipfs.io, https://ipfs.io, http://gateway.ipfs.io, http://ipfs.io, http://localhost, http://localhost:8080, http://127.0.0.1, http://127.0.0.1:8080', but only one is allowed. Origin 'https://ipfs.io' is therefore not allowed access.

Looks like we're returning it incorrectly (it should only return for the origin itself-- i.e. if the user's origin is the same one as one of these, then we return it). I think this has to be fixed in go-ipfs, but tagging here as we should make sure to fix it through to deploy.