Manual CORS headers in response message are stripped

In an HttpTrigger function, I am manually setting CORS headers in the HttpResponseMessage, using C#.

When running in an WebApp, this works perfectly, however when running as a function, my manual CORS headers are stripped and replaced with CORS headers from the function application settings. I need to dynamically set CORS headers as my functions will be access from a variety of domains, and having to continually update the function app to add them in would just not be possible, and the wildcard cannot be used because it is incompatible with the withCredentials: true attribute on the XMLHttpRequest call.

Surely function application headers should only be added when there are no existing headers (which must have been created on purpose), rather than replacing them?

This problem is related to #620, but because I am setting the withCredentials attribute on the call, the workaround to remove all CORS information from the function app, doesn't work. This is therefore a blocker.

Also, the portal complains "Error: CORS is not configured for this function app. Please add https://functions.azure.com to your CORS list."