fix cors test and vary logic

based on feedback given by jplatte in
tower-rs/tower-http#473

src/http/layer/cors/mod.rs

@@ -634,14 +634,15 @@ where
             let req = Request::from_parts(parts, body);
 
             let mut response: Response<ResBody> = self.inner.serve(ctx, req).await?;
+            let response_headers = response.headers_mut();
 
             // vary header can have multiple values, don't overwrite
             // previously-set value(s).
-            if let Some(vary) = response.headers_mut().remove(header::VARY) {
-                headers.append(header::VARY, vary);
+            if let Some(vary) = headers.remove(header::VARY) {
+                response_headers.append(header::VARY, vary);
             }
             // extend will overwrite previous headers of remaining names
-            response.headers_mut().extend(headers.drain());
+            response_headers.extend(headers.drain());
 
             Ok(response)
         }

src/http/layer/cors/tests.rs

@@ -29,7 +29,7 @@ async fn vary_set_by_inner_service() {
         .await
         .unwrap();
     let mut vary_headers = res.headers().get_all(header::VARY).into_iter();
-    assert_eq!(vary_headers.next(), Some(&PERMISSIVE_CORS_VARY_HEADERS));
     assert_eq!(vary_headers.next(), Some(&CUSTOM_VARY_HEADERS));
+    assert_eq!(vary_headers.next(), Some(&PERMISSIVE_CORS_VARY_HEADERS));
     assert_eq!(vary_headers.next(), None);
 }