fix security bug

Origin header not validated correctly for non pre-flight requests
https://github.com/nelmio/NelmioCorsBundle/issues/34