if Access-Control-Allow-Origin is generated dynamically, we should add 'Vary: Origin' header so responses for different origins are not cached
see http://www.w3.org/TR/cors/#resource-implementation