Don't set CORS headers if the Origin header is missing from the request

Current behaviour is broken:

```bash
$ curl -i http://localhost:1337/test
```

```http
HTTP/1.1 200 OK
X-Powered-By: Sails <sailsjs.org>
Access-Control-Allow-Origin: undefined
Access-Control-Allow-Credentials: true
```

After this change the CORS headers are only added if Origin is present in the request. This is similar to e.g. `rack-cors`.