- added support for explicit hostname in origin
- when credentialed access is allowed and origin policy is '*', the real origin is returned verbatim