origins_single option added (always single value in allow-origin header)