fix: respect the allowedHosts option for cross-origin header check
#5510
+123
−7
allowedHosts option for cross-origin header check
#5510