do not cache value of "*-Allow-Origin" header

Previously we generated e the value of the 'Access-Control-Allow-Origin'
once with the function `defaults.origin`. However we actually intended
to use the `Origin` header of each request for itself.

See test case for more.