Only emit vary origin for CORS wildcard mode

If wildcards are not set then the server will respond with a static origin
list per the spec. This behavior can be disabled with the isOriginExposed
flag, effectively forcing wildcard-type behavior.

If wildcards are defined, other the simple *, all requests will have the vary
origin response applied to them.