[fix] Only allow CORS when we have a document.domain to prevent Origin:null. Fixes #281