Set CORS origin header to incoming request origin if allowed