If a request's Origin header is in the allowed origins array, set the Access-Control-Allow-Origin header on the response