[fix] Return the actual req.headers.origin instead of our lowercased version
[fix] Don't override previous set vary headers as they can be used for compression etc