Only send CORS headers if Origin request header is set