When CORS is enabled, permit requests from the same origin as the
fced8da
request host, as the request is not a cross origin. Relates elastic#18256