Improve API 'origin' parameter description

When making CORS pre-flight requests, the origin parameter must still be
included. This means that it cannot be in the POST body, as that is not
sent for pre-flight.

Document that.

Change-Id: I3fc809cf2e4ca9c2566f62d32f96d24377c72863