Listing Origin as an allowed request header is unnecessary

[jub0bs]

The middleware lists Origin as an allowed request header (see here and here). However, listing Origin is never necessary because that header is added to requests by the browser, never by the client.