ringo/stick — pull request #40 by herrernst (2014-01-21 09:54:29+00:00)
Title: 'Vary: Origin' header should even be sent on non-CORS-request ...

... (if there is no Origin header), because otherwise such a request could be cached and used to answer a CORS request (which would then fail)