always add Vary:Origin header if this middleware is active