Making validateOrigin clearer.

- added test for a none CORS request which should pass the validation.