origin header not truthy enough to determine cors