ottoyiu/django-cors-headers — pull request #33 by thedrow (2014-07-02 17:00:51+00:00)
Title: Regex matches will never be evaluated since url.netloc will not be in settings.CORS_ORIGIN_WHITELIST

Please merge and release as soon as possible.

If the first part of the and was true Python won't continue to evaluate the second part of the and clause as an optimization.
That's what is causing the problem.