Hotfix for CORS issue when no Origin header is present.

closes #986, #961