Listing Origin as an allowed request header is unnecessary

[jub0bs]

The middleware lists Origin as an allowed request header (see here and here). However, listing Origin is never necessary because that header is added to requests by the browser, never by the client. You can safely drop Origin from that list.

[vibovenkat123]

Working on fix #155

[rs]

Apparently some old version of Safari required that header to be present during preflight: 849a49a

[jub0bs]

If that used to be true (I haven't been able to find any evidence for this claim), those old versions of Safari are likely long gone and not used by many people.

[jub0bs]

Great.