Scenario:
- Given I have a S3 bucket, with or without any explicit CORS configuration
- Given I do a browser request against any s3 object (it includes an origin header)
- I receive a response with two `Access-Control-Allow-Origin` headers.
  - `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Origin: https://example.com`

*Expected result:* A response with just one `Access-Control-Allow-Origin` header.

*Impact:* all browser based request fail due to a CORS violation. Sending two `Access-Control-Allow-Origin` requests is not allowed.

My setup:
- Mac OS X
- Docker-based setup
- puma-dev to create a local domain

## Example request:
```
$ curl 'https://librario-dev-assets2.library-aws-s3.test/uploads/account/1/asset/file/616af873-b2bb-4c2b-8c5d-77c9ca8026c1/file' -v \
-H 'Origin: https://example.com'
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to librario-dev-assets2.library-aws-s3.test (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: O=Puma-dev Signed; CN=librario-dev-assets2.library-aws-s3.test
*  start date: Oct  1 18:45:24 2019 GMT
*  expire date: Sep 30 18:45:24 2020 GMT
*  subjectAltName: host "librario-dev-assets2.library-aws-s3.test" matched cert's "librario-dev-assets2.library-aws-s3.test"
*  issuer: O=Developer Certificate; CN=Puma-dev CA
*  SSL certificate verify ok.
> GET /uploads/account/1/asset/file/616af873-b2bb-4c2b-8c5d-77c9ca8026c1/file HTTP/1.1
> Host: librario-dev-assets2.library-aws-s3.test
> User-Agent: curl/7.54.0
> Accept: */*
> Origin: https://example.com
>
< HTTP/1.1 404 Not Found
< Access-Control-Allow-Headers: ,authorization,content-type,content-md5,cache-control,x-amz-content-sha256,x-amz-date,x-amz-security-token,x-amz-user-agent,x-amz-target,x-amz-acl,x-amz-version-id,x-localstack-target
< Access-Control-Allow-Methods: HEAD,GET,PUT,POST,DELETE,OPTIONS,PATCH
< Access-Control-Allow-Origin: https://example.com
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: x-amz-version-id
< Content-Length: 244
< Content-Type: text/html; charset=utf-8
< Date: Tue, 01 Oct 2019 18:48:59 GMT
< Server: BaseHTTP/0.6 Python/3.6.8
< Vary: Origin
<
<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>NoSuchBucket</Code>
    <Message>The specified bucket does not exist</Message>
    <BucketName>uploads</BucketName>
    <RequestID>7a62c49f-347e-4fc4-9331-6e8eEXAMPLE</RequestID>
* Connection #0 to host librario-dev-assets2.library-aws-s3.test left intact
</Error>%
```
return json.loads(json.dumps(item))
def remove_non_ascii(text):
    
    text = text.decode('utf-8', CODEC_HANDLER_UNDERSCORE)
    
    text = text.encode('ascii', CODEC_HANDLER_UNDERSCORE)
    return text
class NetrcBypassAuth(requests.auth.AuthBase):
    def __call__(self, r):
        return r
class _RequestsSafe(type):
    """ Wrapper around requests library, which can prevent it from verifying
    SSL certificates or reading credentials from ~/.netrc file """
    verify_ssl = True
    def __getattr__(self, name):
        method = requests.__dict__.get(name.lower())
        if not method:
            return method
        def _wrapper(*args, **kwargs):
            if 'auth' not in kwargs:
                kwargs['auth'] = NetrcBypassAuth()
            if not self.verify_ssl and args[0].startswith('https://') and 'verify' not in kwargs:
                kwargs['verify'] = False
            return method(*args, **kwargs)
        return _wrapper
class safe_requests(with_metaclass(_RequestsSafe)):