change cors protocol based on origin header