Fix Vary header on Cors requests.

Turns out the GzipFilter is overwriting the Vary headers we set...

This is a bit weird, I might make a pull request to Play to fix
Merge pull request #4806 from guardian/vary-header

Fix Vary header on Cors requests.