Allow from specific HTTP_ORIGIN if it exists