Switch cors origin match to string equality