title: S3 CORS policy for public bucket
body: <p>It seems to be easy, but I don't know what I am missing.
  I have a public bucket with a js script that I fetch from my web site. I noticed that I don't send <code>Origin</code> header to S3, it is not required and everything works without any CORS configurations.</p>
  
  <p>What's more, even after I manually added Origin header to that GET call and explicitly disallowed GET and my domain via:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;http://www.nonexistingdomain.com&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;POST&lt;/AllowedMethod&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre>
  
  <p>I can still get the content. What's going on here?</p>