Keep an eye on Referrer-Policy header which must not be set to "no-referrer" for CORS to function. HTTP_ORIGIN = null is/can be a result of no-referrer policy.
But the Pi-hole lighttpd.conf overwrites any server-wide/parent response headers, hence when you chose to install Lighttpd via Pi-hole installer, the reason seems to be a different one.