Allow CORS for login URL

Could you check for the existence of the origin header in the if clause?