Set CORS header on cache only if it has not been set already (fixes #2897)

I love seeing you write Python, @rummik! :dancer: 

Idiomatic Python here would be:

```python
if 'Access-Control-Allow-Origin` not in response.headers:
    ...
```