Adjust CORS origin handling. Closes #1174