Add scheme to cors origin

[noamkush]

(as required by browsers and spec)

[jkarneges]

Thanks, indeed the header was being set incorrectly. But, I think we never should have set it in the first place. I've removed the code instead (5d47ca65c9475dd901c06006ed0de62a3af8d05e).