Vary on Origin when Cors-listener is enabled

When Imbo is running behind a cache such as Varnish and a browser sends a request using XHR with CORS, the Origin header is present. Imbo validates the origin against a whitelist and responds with an Access-Control-Allow-Origin header containing the origin from the request. This is however cached in Varnish, and subsequent requests against the same resource with a different Origin header will get a cached response with a response header which causes the browser to reject the request.

This PR adds Origin to the list of headers to vary on, ensuring that the responses can be cached.