CORS changes: If an Origin header is passed, but is empty, AND, access "*" is enabled, the CORS headers will be returned with Allowed-Origin set to "*".