Invalid CORS now returns a 403 (instead of 500)

[ggrossetie]

Before

$ http :8000/graphviz/svg/eNpLyUwvSizIUHBXqPZIzcnJ17ULzy_KSanlAgB1EAjQ "Origin: lsp:///bad"
HTTP/1.1 500 Internal Server Error
content-length: 41
content-type: text/plain

Error 500: CORS Rejected - Invalid origin

After

$ http :8000/graphviz/svg/eNpLyUwvSizIUHBXqPZIzcnJ17ULzy_KSanlAgB1EAjQ "Origin: lsp:///bad"
HTTP/1.1 403 Forbidden
content-length: 41
content-type: text/plain

Error 403: CORS Rejected - Invalid origin