API returns 403 when Origin header is set without CORS setup

#### Version information:
go-ipfs version: 0.4.19-
Repo version: 7
System version: amd64/linux
Golang version: go1.11.5

#### Type: bug

#### Description:

```
$ ipfs init
$ ipfs config show
{
"API": {
"HTTPHeaders": {}
},
...

$ ipfs daemon &
...
$ curl http://localhost:5001/api/v0/version
{"Version":"0.4.19","Commit":"","Repo":"7","System":"amd64/linux","Golang":"go1.11.5"}
$ curl -H 'Origin: http://example.com' http://localhost:5001/api/v0/version
403 - Forbidden

$ ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '["*"]'

$ curl http://localhost:5001/api/v0/version
{"Version":"0.4.19","Commit":"","Repo":"7","System":"amd64/linux","Golang":"go1.11.5"}
$ curl -H 'Origin: http://example.com' http://localhost:5001/api/v0/version
{"Version":"0.4.19","Commit":"","Repo":"7","System":"amd64/linux","Golang":"go1.11.5"}
```

As shown in the previous example, if no CORS setup is done, any request with a `Origin` header will be denied. This breaks a few usecases, including handling CORS in a proxy sitting in front of `go-ipfs`.