do not cache value of "*-Allow-Origin" header

Previously we generated e the value of the 'Access-Control-Allow-Origin'
once with the function `defaults.origin`. However we actually intended
to use the `Origin` header of each request for itself.
Merge pull request #12 from bodokaiser/allow-origin-fix

do not cache value of "*-Allow-Origin" header