Remove duplicate Vary: Access-Control-Request header

This is already included a few lines up in the same method and doesn't
need to be sent a second time.

Change-Id: I51265bddfec8167970a2da52320915314c9384ed

gerrit-httpd/src/main/java/com/google/gerrit/httpd/restapi/RestApiServlet.java

@@ -591,7 +591,6 @@ public class RestApiServlet extends HttpServlet {
 
     String headers = req.getHeader(ACCESS_CONTROL_REQUEST_HEADERS);
     if (headers != null) {
-      res.addHeader(VARY, ACCESS_CONTROL_REQUEST_HEADERS);
       for (String reqHdr : Splitter.on(',').trimResults().split(headers)) {
         if (!ALLOWED_CORS_REQUEST_HEADERS.contains(reqHdr.toLowerCase(Locale.US))) {
           throw new BadRequestException(reqHdr + " not allowed in CORS");