If a request's Origin header is in the allowed origins array, set the Ac...

...cess-Control-Allow-Origin header on the response