CORS: Do not validate Origin header on non-OPTION requests

The Origin header should not be validated on non OPTION-requests.
This provides no additional security and breaks non-web browser requests
which do not supply an origin header.

Fixes #271

src/middleware/cors.rs

@@ -424,7 +424,10 @@ impl<S> Middleware<S> for Cors {
                     .finish(),
             ))
         } else {
-            self.validate_origin(req)?;
+            // Only check requests with a origin header.
+            if req.headers().contains_key(header::ORIGIN) {
+                self.validate_origin(req)?;
+            }
 
             Ok(Started::Done)
         }