isCorsRequest already check if it has Origin, there is no need to specify "null" as default value.