def OriginResponse(request, allowOrigins='*', allowCredentials=True,
    exposeHeaders='', response=None):
    """
    Handles Access-Control responses to Origin header containing requests. This function
    adds required headers only and does not change the reponse.

    Returns None if the Origin does not match or the header is not present in the request.

    :param request: The current request.
    :param exposeHeaders: A list of custom headers to be made accessible in the client application as string.
    :param allowCredentials: True/False. Credentials are made accessible in the client application.
    :param response: The response to be returned. if None `request.response` is used.
    :return: response or None
    """
    response = response or request.response
    origin = request.headers.get('Origin')
    if origin is None or allowOrigins is None:
        return response
    if allowOrigins != '*':
        if not origin in allowOrigins and not '*' in allowOrigins:
            return None
    headers = [('Access-Control-Allow-Origin', origin), (
        'Access-Control-Allow-Credentials', str(allowCredentials).lower()),
        ('Access-Control-Expose-Headers', exposeHeaders), ('Vary',
        'Accept-Encoding, Origin')]
    if hasattr(response, 'headerlist'):
        headers += list(response.headerlist)
    response.headerlist = headers
    return response
