Accept all headers through cors
Return the request origin with OPTIONS requests, since credentials can't be sent with * as allow origin