Reorder CORS header syntax. Split Origin from it too.