Use matched origin for non-credential CORS.

This means that we can return `Access-Control-Allow-Origin: *` for non-authenticated requests. Fixes #608