I have the working, but some 400 errors turn into 403 errors. This happens for
malformed CORS preflight requests. Also if an Origin is invalid, but the user
doesn't have REST access, the returned code is now 403 when it was 400 before.

I don't think this is a problem. For CORS, an error is an error so I claim
400 or 403 is all the same.

By requiring the user to have REST access, unauthorized users can't probe
valid ORIGIN headers.

It does have an upgrading.txt info notice as well as a CHANGES.txt entry.