Use req.headers.origin
Simplfied CORS