fix: add 'Vary: Origin' header to cors response

src/lib/middleware/conditional-middleware.ts

@@ -7,6 +7,7 @@ export const conditionalMiddleware = (
     const router = Router();
 
     router.use((req, res, next) => {
+        res.setHeader('Vary', 'Origin');
         if (condition()) {
             middleware(req, res, next);
         } else {

src/lib/middleware/secure-headers.ts

@@ -76,6 +76,7 @@ const secureHeaders: (config: IUnleashConfig) => RequestHandler = (config) => {
                 },
             },
             crossOriginEmbedderPolicy: false,
+            originAgentCluster: false,
         });
     }
     return (req, res, next) => {