[fix] Set the `Vary` response header

According to https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Access-Control-Allow-Origin,
> If the server specifies an origin host rather than "*", then it must also include `Origin` in the `Vary` response header to indicate to clients that server responses will differ based on the value of the `Origin` request header.

and according to http://www.w3.org/TR/cors/#access-control-allow-origin-response-header, the value of the `Access-Control-Allow-Origin` header, when different from `*`, must be either a single origin or the string `null`.

This to correctly follow the specifications but i would love to have another pair of eyes here.