[identity] fix origin validation logic

Summary: on prod, we should not require a port in the allow origin list. https://web.comm.app should work.

Test Plan:
there's no good way to test this on prod currently.

added unit test to make sure "https://web.comm.app" origin works. this should unblock release.

To test if grpc-web works on prod, @bartek suggested that we silently add some Ping calls in the next web release and just see if they fail or not

Reviewers: will, bartek

Reviewed By: will

Subscribers: ashoat, tomek

Differential Revision: https://phab.comm.dev/D12106