bug: fix crash unguarded reference allowed_origins[0]

Make sure allowed_origins is not empty.

Author: rouilj

roundup/cgi/client.py

@@ -1290,7 +1290,7 @@ def is_referer_header_ok(self, api=False):
             return False
 
         allowed_origins = self.db.config['WEB_ALLOWED_API_ORIGINS']
-        if allowed_origins[0] == '*':
+        if allowed_origins and allowed_origins[0] == '*':
             return True
 
         # For referer, loop over allowed_api_origins and