Corrected a typo (Access-Control-Allow-Orgin instead of Origin), and fixed CORS request (added Allow-Headers and Allow-Methods response headers)