Add test that CORS values unsent without origin
Add test that CORS values unsent without origin

Modify the integration test 'ensure getting project has
expected values (esp. security headers)' to ensure that
CORS headers aren't sent when an Origin isn't sent, as
that is the implemented behavior.

This means that we check the CORS header values in two
cases: (1) when an origin is not sent (this commit), and
(2) when an origin is sent.  We just want to make sure
that no matter what is done, we send CORS header values
that are secure.

Signed-off-by: David A. Wheeler <9ae72d22d8b894b865a7a496af4fab6320e6abb2@dwheeler.com>

linuxfoundation/cii-best-practices-badge,yannickmoy/cii-best-practices-badge,coreinfrastructure/best-practices-badge,yannickmoy/cii-best-practices-badge,yannickmoy/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,yannickmoy/cii-best-practices-badge,coreinfrastructure/best-practices-badge,linuxfoundation/cii-best-practices-badge,coreinfrastructure/best-practices-badge,coreinfrastructure/best-practices-badge