Bug fix: If cors.allowOrigin is not set, allow all

I was referencing the response instead of the request to get the Origin
header.