Gateway has unkillable CORS headers

#### Version information:

```
ipfs version --all
go-ipfs version: 0.4.19-
Repo version: 7
System version: amd64/linux
Golang version: go1.11.5
```
#### Type: bug

#### Description:

The gateway is configured by default with `HTTPHeaders` being:
```
{
"Access-Control-Allow-Headers": [
"X-Requested-With"
],
"Access-Control-Allow-Methods": [
"GET"
],
"Access-Control-Allow-Origin": [
"*"
]
}
```

When changed to:

```
{
"X-Pwet": [
"hello"
]
}
```

The gateway still return the CORS headers, even though the config is gone:

```
< HTTP/1.1 200 OK
< Accept-Ranges: bytes
< Access-Control-Allow-Headers: Content-Type
< Access-Control-Allow-Headers: Range
< Access-Control-Allow-Headers: User-Agent
< Access-Control-Allow-Headers: X-Requested-With
< Access-Control-Allow-Methods: GET
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: Content-Range
< Access-Control-Expose-Headers: X-Chunked-Output
< Access-Control-Expose-Headers: X-Stream-Output
< Cache-Control: public, max-age=29030400, immutable
< Content-Length: 12
< Content-Type: text/plain; charset=utf-8
< Etag: "QmXvrr3gPtddcNrisH7i2nan9rY7v7RcxVQ9jjRreoWwRS"
< Last-Modified: Thu, 01 Jan 1970 00:00:01 GMT
< Suborigin: ipfs000bciqi47fhgcpe6mrmoijkvsbgzb55a537hjfrc5e6yyz73vxopwfe52i
< X-Ipfs-Path: /ipfs/QmXvrr3gPtddcNrisH7i2nan9rY7v7RcxVQ9jjRreoWwRS
< X-Pwet: hello
< Date: Thu, 11 Apr 2019 20:04:33 GMT
```

I'd like to argue that go-ipfs should respect the configuration, and not return those headers anymore in this case.

On a side note, as you can see, the gateway return multiple `Access-Control-Allow-Headers` and `Access-Control-Expose-Headers`. My understanding is that while this is legal, it also might cause incompatibility issues and is generally less easy to deal with (at least in go). The API return instead the same headers only once, with a list of values.