Origin request header and Access-Control-Allow-Origin

According to https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin#Examples

> Limiting the possible Access-Control-Allow-Origin values to a set of allowed origins **requires code on the server side to check the value of the Origin request header, compare that to a list of allowed origins, and then if the Origin value is in the list, to set the Access-Control-Allow-Origin value to the same value as the Origin value.**

But https://github.com/eggjs/egg-cors just set `Access-Control-Allow-Origin` and don't compare `Origin` header