Header always set Access-Control-Allow-Origin "*" "expr=env('cors') = '1'"
Header always set Access-Control-Allow-Credential "true" "expr=env('cors') = '1'"
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT" "expr=env('cors') = '1'"
Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, Accept-Encoding, client-security-token" "expr=env('cors') = '1'"
#Header always set X-Frame-Options "*" "expr=env('cors') = '1'"
Header always unset X-Frame-Options
Header set Cache-Control "max-age=86400, public" "expr=env('cors') = '1'"
Header append Vary User-Agent
