Use header Origin in response headers when available

Since the RFC [1] doesn't allow wildcards for credentialed requests,
add the requested Origin into the response headers.

[1] https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Requests_with_credentials