Fixing set_access_origin hook

set_access_origin hook now actually responds correctly for CORS. It now
gets the ORIGIN header instead of the host header.