Test CORS with routes with no/non-http origin headers