Disable CORS support by default
Rename methods to be consistent with header names
Remove Vary header since its not a general usecase

The `Vary: Origin` is to secure caching if the returned data is
different depending on the host making the request.
Handle CORS request early to discard invalid requests