I do not believe this is a 'TODO Should' question - I believe this is a MUSTDO.  If we are allowing cross origin requests then the allowed origin must be a known and trusted origin.