Allowed CORS pre-flight without origin