Update cors.js

Allow origin to be echoed back in response header (as per OWASP recommendations) regardless of credentials set to true.
Merge pull request #456 from occasl/master

Update cors.js