Issue #2853201 by hampercm, dawehner: [upstream] CORS breaks form submission unless allowed origins includes site's own host