Merge pull request #39 from herrernst/master

Add 'Vary: Origin' header
'Vary: Origin' header should even be sent on non-CORS-request (if there is no Origin header), because otherwise such a request could be cached and used to answer a CORS request (which would then fail)