env['HTTP_ORIGIN'] header logic

If you don’t send the HTTP_ORIGIN header, then it’s not a CORS request
and i won’t block it.