CORS checks need to use the redirected URL

[ithinkihaveacat]

A URL like https://cnn.com/ampstories/us/who-is-sandra-day-oconnor is actually redirected to https://www.cnn.com/ampstories/us/who-is-sandra-day-oconnor. The CORS checks need to be use the redirected URL, not the original URL.

Actual:

# returns 401
curl -i -H 'origin: https://cnn-com.cdn.ampproject.org' 'https://stamps.cnn.io/api/related?storyId=5bcf38eb4db3d70020c01c4f&__amp_source_origin=https%3A%2F%2Fcnn.com'

Expected:

# returns 200
curl -i -H 'origin: https://www-cnn-com.cdn.ampproject.org' 'https://stamps.cnn.io/api/related?storyId=5bcf38eb4db3d70020c01c4f&__amp_source_origin=https%3A%2F%2Fwww.cnn.com'