nginx appears to add an automatic `Access-Control-Allow-Origin: *` based on User Agents?

00_with_user_agent.txt

$ curl -i --user user:secret 'https://api.example.com' -H 'User-Agent: Mozilla/5.0'
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 30 Jul 2014 17:55:43 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 2869
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Origin: https://example.com

01_without_user_agent.txt

$ curl -i --user user:secret 'https://api.example.com'
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 30 Jul 2014 17:56:44 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 2869
Connection: keep-alive
Access-Control-Allow-Origin: https://example.com