Use explicit origin when with credentials

[gyusang]

• Initially raised as discussion CORSMiddleware does not provide explicit origin although client credential is present #1823

Edit by @Kludex:

• Closes CORSMiddleware does not provide explicit origin although Authorization header is present #1832

[Kludex]

Can you add a test, please?

[gyusang]

Can you add a test, please?

Yes, I have added a test for the added functionality.

[Kludex]

I'm not sure about this idea. I don't see any CORS implementation using a custom logic for cookies or authorization headers.

But I do see a different logic when "allow_credentials" is true, that we don't have.

[Kludex]

@gyusang I think we still need a bit of discussion around this. I took a bit of time to search around, and I didn't find any implementation that does what we do, nor expand the logic as this PR suggests.

Let's continue this on #1832, please. 🙏