SECURITY: Fix CORS origin matching in the API

Bug: T77028
Change-Id: I68c1ee5b5a048af2aba4e710bc301b09748389bf