Set Vary: Origin on CORS requests

The Access-Control-Allow-Origin header is set depending on the request's Origin
header. Although most requests also send Cache-Control headers with no-cache,
the OPTIONS requests for CORS pre-flight requests do set cache headers.

See http://www.w3.org/TR/cors/#resource-implementation