'Vary: Origin' header should even be sent on non-CORS-request ...

... (if there is no Origin header), because otherwise such a request could be cached and used to answer a CORS request (which would then fail)