I got tripped by this once - a tester at work accidentally added a trailing . to a dev site URL and everything was broken... because the CORS code didn't account for a trailing . in the URL.