httpd duplicate Access-Control-Allow-Origin with “Header always set”

Question

I am trying to enable CORS on my server. It hosts both an Apache HTTPD and an Apache Tomee. HTTPD is configured as:

SetEnvIf Origin \"^https://(.+\\.)?my-dom