Updated Access-Control-Allow-Origin header to use the origin URL by default instead of *