Missing response header "Vary: Origin"

[ostrya]

According to MDN Access-Control-Allow-Origin, since the CORS filter returns an Access-Control-Allow-Origin response header based on the Origin header of the request, the response should contain the header "Vary: Origin" to indicate that a different Origin may result in a different response.