Only emit vary origin for CORS wildcard mode

If wildcards are not set then the server will respond with a static origin list per the spec. This behavior can be disabled with the isOriginExposed flag, effectively forcing wildcard-type behavior.

If wildcards are defined, other the simple *, all requests will have the vary origin response applied to them.
Merge pull request #1171 from spumko/cors-vary

Only emit vary origin for CORS wildcard mode