bugfix: the allow-origin headers use the request Origin header now