pub fn origin_allowed(headers: &HeaderMap, allowed: &[String]) -> bool
Check Origin against an allowlist. Empty allowlist → allow all (dev default).
Origin