- in an actual request, no *-allow-* is returned if there would be no matching origin
- added tests