! http: add HttpOrigin and use it for Access-Control-Allow-Origin and Origin headers, fixes #579