Extra proof that the Origin header is key in CORS