Only use CORS headers if the request has a Origin header