Only set access-control-allow-origin if the origin header value matches (or '*' is allowed)

I don't necessarily want to make known which origins are allowed for a private service. I could see allowing '*' to always be sent as a sign that this is a public service so this diff might not be the perfect (ish) solution.