Use origin headers for CORS if available