Update CORS to respond with specific origin

When put behind basic auth, CORS requests don't allow the use of
a wildcard ("*") for Access-Control-Allow-Origin:

http://www.w3.org/TR/cors/#resource-requests

We ran into this while having nginx with basic auth proxy to our es
node. It should effectively be the same as what is there for CORS
requests, but respond with the origin. Happy to update for any
changes neccessary.