Header always set Access-Control-Allow-Origin "https://www.example.com" Header always merge Vary "Origin"