Add more support to origins checking (dont require domain whitelisting, allow path matches)