[BUG] CORS middleware sets `Vary: Origin` header only in some cases

[toaster]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When using the CORS handler with an AllowedOriginValidator, the Vary header is not set to Origin.

Expected Behavior

The header (Vary: Origin) should always be set when a validator function is present because the middleware cannot predict the outcome of the function and whether it might change for different input.

[jub0bs]

Recommended reading about why CORS libraries should not support custom callbacks like AllowedOriginValidator.