Allowing the Origin header is necessary for Safari.

Safari by default sets:
Access-Control-Request-Headers: accept, origin

While Chrome and Firefox set:
Access-Control-Request-Headers: accept