Allow null or undefined origins when allowed origins is a function

Requests without an Origin header previously caused an exception to be thrown if the allowed origins passed to the constructor was set to a dynamic function. Omitted origins are now set to an asterisk and passed properly to the origins function.

A test for this case is included in this commit.