Fixes #9640 The auto-derived CORS origin logic (added in #9603 for the wildcard-bind case) ran unconditionally, so it clobbered an explicitly-passed --rc-allow-origin too - the flag was silently ignored. That breaks the documented Docker/remote-browser setup where the bind address and the address the browser actually reaches the GUI at are different. Now it only kicks in when the user hasn't set --rc-allow-origin themselves.