#74 allowing all origins, even when not set on the server