check same host policy on normalized source URL, fixes #13