Fix check for Access-Control-Allow-Origin

And shuffle some lines around to make it clearer what the comment
governs.