The problem with filter_var is that it will return false for "example.com". iirc I've seen many CORS requests where the Origin is not using the schema.