spumko/hapi — pull request #1171 by kpdecker (2013-11-22 21:01:28+00:00)
Title: Only emit vary origin for CORS wildcard mode

If wildcards are not set then the server will respond with a static origin
list per the spec. This behavior can be disabled with the isOriginExposed
flag, effectively forcing wildcard-type behavior.

If wildcards are defined, other the simple *, all requests will have the vary
origin response applied to them.