ALLOW_ALL should return the origin as allowed header