Enforce issuer origin URL to be current site URL