v0.2.2

Changed

• Edge: ALLOWED_ORIGIN accepts a comma-separated origin list. The CORS header can only
  carry one origin, so the list is matched against the request's own Origin and echoed back at
  a single fetch boundary (finalizeCors); Vary: Origin rides along so a cache never serves
  one origin's header to another. Single-origin and wildcard (*) behavior are unchanged, and
  the 55 json()/cors() call sites are untouched. (PR #58.)