Use request origin value for CORS allow-origin.