only set allow_origin_pat if defined

fixes the default behavior to be as intended (require Origin == Host)