Re-introduces fallback to Referer header for CORS if no Origin header present