Access-Control-Allow-Origin iRule Strange Error

I hope somebody here can help me. I've been sitting on this issue for over 8 hours now.

I'm trying to enable CORS in my loadbalancer. I created an iRule which should intercept all OPTIONS type requests (because our backend cannot handle them) and answer it with the appropriate headers:

when HTTP_REQUEST {
  if { [HTTP::method] eq "OPTIONS" } {
    HTTP::respond 200 -version 1.1 \
      Date "[clock format [clock seconds] -format "%a, %d %b %Y %H:%M:%S %Z"]" \
      Connection "Keep-Alive" \
      Keep-Alive "timeout=3, max=250" \
      Access-Control-Allow-Origin "*" \
      Access-Control-Allow-Methods "GET, HEAD, POST, PATCH, PUT" \
      Access-Control-Allow-Headers "Accept, Authentication, Authorization, Content-Encoding, Content-Length, Content-MD5, Content-Type, If-Match, If-None-Match, X-CUST-Header1, X-CUST-Header2" \
      Access-Control-Expose-Headers "Content-Encoding, Content-Length, Content-MD5, Content-Type, ETag, Location, X-CUST-Header3, X-CUST-Header4" \
      Access-Control-Max-Age "3600"
    event HTTP_REQUEST disable
  }
}

I've tried adding "*", "[HTTP::header Origin]" and the actual origin URL to Access-Control-Allow-Origin and tested it with 4 different browsers (FF34, FF38, Opera 29 and Chrome 43).

The result is always the same: if the Access-Control-Allow-Origin header would match I get an error in the developer console ("F12" in most browsers), that the header is missing. But! You can see the header in the response headers and the XHR seems to work! See screenshot:

If I put some random URL into the header the developer console says that the header does not match.

(Before the loadbalancer I had Apache to set the headers, that way I had no CORS error in the developer console of the browsers - but I had some other problems.)

Has anybody encountered this?

Firmware: 11.5.1-HF8