add origin to cache key

This reverts my changes to always send * as allow-origin header.

It adds 'origin' to the cache key.  This fixes an error where the 'allow-origin' header is stored in the cache, and different pages request the exact url and get the wrong allow-origin header back.