Update cors.js

Allow origin to be echoed back in response header (as per OWASP recommendations) regardless of credentials set to true.  Related to issue #446.