add vary origin header for specifc origins

If the server specifies an origin host rather than "*", then it must
also include Origin in the Vary response header to indicate to clients
that server responses will differ based on the value of the Origin
request header.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Access-Control-Allow-Origin