to the client (not cookies only). This is used by some servlets to mainly set "Access-Control-Allow-Origin" header. Added a contains check to be sure no header set by Defaultservlet is overwritten.