CORS check

OPTIONS with a foreign Origin. Flags * , reflected origins with credentials, and Origin: null.