Testing this locally shows that the HTTP_ORIGIN header is expected to not be set if the call is not a CORS call. This should be fine ... just do nothing.
Turn assertion warnings on if the debug flag is set.
Turning PRESTO_DEBUG on. It seems to me this should be on for development, but I will check with @ngallagher before merging.