Access-control origin for interaction requests