CORS headers not sent if Origin is an empty string

[michaelbironneau]

According to Mozilla information on CORS it is valid to send a blank "Origin" header. However, the Cors middleware will not send a Access-Control-Allow-Origin header if the "Origin" header in the request is blank (even if allowed origin is "*").

The middleware should check that the "Origin" header is present, but it should not regard requests with blank "Origin" headers as invalid access control requests.