Fix logic around allowing an empty Origin header if *