Set CORS origin header to incoming request origin if allowed

Closes #483