Set CORS header on cache only if it has not been set already (fixes #2897)

Turns out this was not only non-idiomatic, it was broken: in many cases we don't have `Access-Control-Allow-Origin` in `response.headers` at all, so we were raising `Response(400)`.