better log messages when rejecting cross-origin requests