--- a/wp/wp-includes/rest-api.php	Tue Oct 15 11:56:20 2019 +0200
+++ b/wp/wp-includes/rest-api.php	Tue Oct 15 15:48:13 2019 +0200
@@ -587,6 +587,8 @@
 		header( 'Access-Control-Allow-Origin: ' . $origin );
 		header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
 		header( 'Access-Control-Allow-Credentials: true' );
+		header( 'Vary: Origin', false );
+	} elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
 		header( 'Vary: Origin' );
 	}