improved CORS support to check Origin agains configured ones - closes #160