CORS origin bug fixes and enhancements

Closes #1111 

Also:
* Add `Vary` header when using incoming `Origin` header to set response
* Fix misc `Vary` headers sets to not override previous values
* Not replace `*` with incoming `Origin` value
* Not allow `cors.origin` to include `'*'` with any other value