--- a/web/cors.py	Tue Jul 15 16:07:59 2014 +0200
+++ b/web/cors.py	Tue Jul 29 16:27:11 2014 +0200
@@ -109,6 +109,6 @@
              '%s != %s' % (host, myhost))
         raise CORSFailed('Host header and hostname do not match')
     # include "Vary: Origin" header (see 6.4)
-    req.set_header('Vary', 'Origin')
+    req.headers_out.addHeader('Vary', 'Origin')
     return origin