Allow null origin on GET requests
In #10058 (closed) we allowed PUT and DELETE request for null origin. But browsers applies CORS also to Javascript requests even for GET (see https://stackoverflow.com/questions/42239643/when-do-browsers-send-the-origin-header-when-do-browsers-set-the-origin-to-null/42242802) So we need to allow null origin for all routes used by Chronos.