cors_origins_for() doesn't seem to be used anywhere besides the tests; should it be used when checking the OPTIONS request?