Allow both "file://" and "null" origins when `origin "file://"` is configured

This addresses the problem described in #53 by moving the code that considers "file://" and "null" equivalent down into the origin check, thus preserving the original `Origin` header to be used in `Access-Control-Allow-Origin`.

There's a test included (which passes). One of the existing tests fails intermittently for me, but that is true without this patch as well.